NSE7 Troubleshooting and Diagnostics — Timed 10 Questions

Question 1

Which TWO actions are appropriate when troubleshooting a slow network connection through a FortiGate?

Accepted Answer

Check the CPU and memory utilization on the FortiGate.. High CPU or memory utilization on a FortiGate can directly cause packet drops, queuing delays, and slow throughput, especially under load. Checking these resources is a fundamental first step in troubleshooting performance issues. Additionally, verifying the routing table ensures that traffic is being forwarded via the correct next-hop interfaces; incorrect routing can lead to suboptimal paths or blackholing, resulting in perceived slowness. Both actions help isolate the root cause of a slow connection.

Answer

Increase the session TTL to reduce session setup overhead.

Answer

Disable flow control on the WAN interface.

Answer

Disable all security profiles to free resources.

Question 2

You are troubleshooting a BGP neighbor flapping. The neighbor state shows 'Active'. Which command will help you see the reason for the state change?

Accepted Answer

get router info bgp neighbors. The 'get router info bgp neighbors ' command displays detailed information about a BGP neighbor, including its current state (e.g., Active, Established) and a history of state changes. This helps identify why the session is flapping, as it shows the last few state transitions and the associated reasons (e.g., timeouts, resets). The 'Active' state indicates the router is trying to establish a TCP connection, and the neighbor details can reveal issues like misconfigured IP addresses, AS numbers, or authentication. Option B is incorrect because 'get router info bgp neighbors rejected-routes' shows routes that were rejected by policy, not the reason for state changes. Option C shows routes received from the neighbor, and Option D provides a summary, neither of which directly reveals why the state changed.

Answer

get router info bgp neighbors <neighbor> rejected-routes

Answer

get router info bgp neighbors <neighbor> received-routes

Answer

get router info bgp summary

Question 3

An administrator runs 'diagnose sys session filter dport 443' and sees output indicating sessions with state 'proto=6 proto_state=01 duration=3600 expire=3598'. What does this output indicate about the session?

Accepted Answer

The session is an expired TCP session that is being removed. The session shows proto=6 (TCP) and proto_state=01, which in FortiOS indicates TCP state SYN_SENT. The duration of 3600 seconds and expire of 3598 seconds suggest the session has been in SYN_SENT for an extended period, which is abnormal. Default SYN_SENT timeout is much shorter, so this session is likely stuck or expired and will be removed soon. Therefore, option A correctly describes it as an expired TCP session being removed.

Answer

The session is a UDP session to port 443 that has been idle for 3600 seconds

Answer

The session is an established TCP session to port 443, lasting 3600 seconds with 3598 seconds remaining

Answer

The session is blocked by a firewall policy and has been logged

Question 4

A FortiGate HA cluster is experiencing persistent split-brain even after both units are rebooted. Which THREE actions should the administrator take to resolve this issue? (Choose three.)

Accepted Answer

Verify that the heartbeat interfaces are properly connected and configured. Split-brain occurs when HA peers lose communication over the heartbeat link, causing each unit to assume the other is down and both become active. Option A is correct because verifying the heartbeat interfaces ensures the dedicated link is functional, which is the most common root cause. Option B is correct because increasing the HA failover hold time (hold down time) can prevent transient network issues from triggering false failovers and flapping, which often resembles split-brain behavior. Option D is correct because split-brain is more likely in active-active mode; configuring active-passive mode ensures only one unit is active at any time, eliminating the possibility of both units operating independently.

Answer

Reduce the priority on the secondary unit

Answer

Disable HA on both units and re-enable

Question 5

A FortiGate is experiencing high memory usage due to a large number of UDP sessions. The administrator wants to reduce memory consumption without dropping legitimate traffic. Which THREE actions could help? (Choose three.)

Accepted Answer

Enable session-ttl to enforce idle timeout. Enabling session-ttl enforces an idle timeout on UDP sessions, preventing them from lingering indefinitely after traffic stops. This reduces memory consumption by ensuring stale UDP sessions are removed without affecting active traffic. Option C is correct because reducing the UDP session timeout shortens the time inactive UDP sessions remain in memory, freeing up resources sooner. Option D is correct because disabling unnecessary session helpers for UDP reduces the memory overhead associated with processing and tracking sessions that don't require deep inspection, further lowering memory usage without dropping legitimate traffic.

Answer

Increase the maximum session limit

Answer

Upgrade the FortiGate hardware

Question 6

An administrator is investigating a security incident using FortiAnalyzer logs. The admin needs to identify all connections from a specific internal IP (10.0.0.100) to external servers on TCP port 443 during the last hour. Which TWO log fields should be used to filter the logs? (Choose two.)

Accepted Answer

dstip. To identify all connections from the specific internal IP 10.0.0.100 to external servers on TCP port 443, the administrator should filter logs using dstip (destination IP) to specify the internal IP as the destination (since logs record the direction from the policy perspective), and policyid to isolate traffic handled by a particular security policy. This combination ensures accurate identification of all relevant connections.

Answer

dstport

Answer

srcip

Answer

action

Question 7

An administrator is troubleshooting a VPN tunnel between two FortiGates. The phase 1 fails to come up. The administrator runs 'diagnose vpn ike log' and sees the error 'no proposal chosen'. Which THREE configuration mismatches could cause this error?

Accepted Answer

Different Diffie-Hellman groups (e.g., DH5 vs DH14). The 'no proposal chosen' error occurs during IKE phase 1 when the peers cannot agree on a common set of security parameters. The three mismatches that cause this error are: A) Different Diffie-Hellman groups (e.g., DH5 vs DH14) because the DH group is part of the IKE proposal; B) Different encryption algorithms (e.g., AES128 vs 3DES) because both sides must use the same encryption algorithm; and E) Different IKE mode (main vs aggressive) because the mode is negotiated in the IKE proposal. Options C and D cause different errors: mismatched IPs typically result in 'no response' or 'no peer found', while mismatched pre-shared keys result in authentication failures (e.g., 'encryption/decrption failed').

Answer

Mismatched local and remote gateway IPs

Answer

Mismatched pre-shared keys

Question 8

A network admin is investigating a high CPU usage issue on a FortiGate firewall. The admin runs 'diagnose sys top' and sees that the 'ipsengine' process is consuming 70% CPU. Which THREE actions should the admin take to reduce CPU load?

Accepted Answer

Review and optimize IPS signatures; disable unnecessary signatures. Disabling unnecessary IPS signatures reduces pattern-matching operations, lowering CPU load. Option D, while extreme, reduces CPU load by stopping all IPS inspection; it can be a temporary measure during troubleshooting. Option E is correct because NPU offloading shifts IPS processing to hardware, reducing CPU usage. Options B and C are incorrect: increasing process priority would starve other processes and likely worsen overall system performance.

Answer

Increase the IPS engine process priority

Answer

Increase the IPS engine process priority

Question 9

An administrator is investigating a security incident using FortiAnalyzer logs. The admin wants to identify all traffic that matched a specific firewall policy. Which TWO log fields should the admin use to filter the logs?

Accepted Answer

policyid. The 'policyid' field in FortiAnalyzer logs directly corresponds to the firewall policy ID that processed the traffic. Filtering on this field isolates all log entries matched against a specific policy. Option E is also correct because the 'srcintf' field indicates the source interface of the traffic. Since firewall policies are often applied to specific interfaces, filtering by source interface can help narrow down logs related to a particular policy, especially when the policy is associated with that interface. Together, these two fields provide an effective way to identify traffic that matched a specific firewall policy.

Answer

user

Answer

appid

Answer

dstip

Question 10

A FortiGate in an HA cluster is experiencing intermittent session synchronization failures. The administrator runs 'diagnose sys ha dump sync-status' and sees that sessions are not being synchronized properly. Which TWO potential causes should the administrator investigate?

Accepted Answer

Excessive number of sessions exceeding the session sync limit. FortiGate HA has a configurable session sync limit (default 500,000 sessions). When the number of concurrent sessions exceeds this limit, the FortiGate stops synchronizing new sessions to the backup unit, leading to intermittent synchronization failures. This can be verified by checking the 'ses_sync_limit' value in the HA configuration and comparing it to the current session count. Option D is correct because high packet loss or latency on the heartbeat interface can cause session synchronization failures. The heartbeat interface carries synchronization traffic, and any degradation in its performance can lead to missed or delayed sync packets, resulting in intermittent sync failures. This can be diagnosed by checking heartbeat interface statistics such as packet loss and latency.

Answer

Mismatched HA group IDs

Answer

Incorrect BGP route advertisements

Answer

Mismatched HA passwords