How many Troubleshooting Scenario Questions questions are on this page?

This page has 12 Troubleshooting Scenario Questions scenario questions for the FORTINET-NSE123 exam, each with detailed explanations and wrong-answer analysis.

How should I approach FORTINET-NSE123 scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to Fortinet NSE 1-3 (Network Security Associate track: Foundational, Technical Introduction, Associate) (FORTINET-NSE123) questions

Scenario-based practice

Troubleshooting Scenario Questions

Practise Fortinet NSE 1-3 (Network Security Associate track: Foundational, Technical Introduction, Associate) (FORTINET-NSE123) practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice test Read exam guide

scenario questions

FORTINET-NSE123

exam code

Fortinet

vendor

Scenario guide

How to approach troubleshooting scenario questions

These questions describe a network symptom and ask you to identify the root cause or the correct fix. They appear across all certification exams and reward systematic thinking over memorisation. The best candidates follow a consistent troubleshooting framework even under time pressure.

Quick answer

Troubleshooting Scenario Questions questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Practice scenarios

Question 1hardmultiple choice

Full question →

An administrator is troubleshooting high memory utilization on a FortiGate. They run 'get system performance status' and see that memory usage is in conserve mode. What immediate action does FortiOS take when entering conserve mode?

A
It stops allocating memory for certain cache operations and may block new non-administrative connection attempts.
Conserve mode triggers FortiOS to halt memory allocation for non-essential cache operations and refuse new non-administrative connections, preserving memory for critical processes. This directly addresses the high memory utilisation constraint, keeping the FortiGate responsive and administrative access available.
B
It immediately reboots the device to clear RAM.
Why it fails: Conserve mode does not reboot the FortiGate; it drops new sessions and blocks resource-heavy processes to free RAM. Rebooting is tempting as a generic memory remedy, but it would only be the correct action when a device is unresponsive and cannot recover through normal conserve-mode protections.
C
It wipes all historical log files from local disk storage.
Why it fails: Conserve mode does not wipe local logs; log storage is managed separately through log settings and disk quotas. Deleting logs is tempting because logs consume disk, but it would be the correct action only when disk space, not RAM, is the constrained resource triggering the problem.
D
It automatically initiates a firmware rollback to the previous stable version.
Why it fails: Conserve mode never triggers a firmware rollback; that is a manual administrative recovery step. Rollback is tempting because firmware faults can cause memory leaks, but it would be the correct choice only after confirming a specific firmware defect, not as an automatic FortiOS response to memory pressure.

Full breakdown with real-world context →

Question 2mediummultiple choice

Read the full DNS explanation →

An administrator needs to test DNS resolution directly from the FortiGate command line interface to troubleshoot a FortiGuard connectivity issue. Which command should be used?

A
execute dns-lookup [hostname]
The execute dns-lookup command queries a DNS server directly from the FortiGate CLI, returning the resolved address or failure needed to diagnose FortiGuard name resolution. It satisfies the requirement to test DNS resolution from the command line.
B
ping [hostname]
Why it fails: ping resolves the hostname then sends ICMP echo requests, so it tests reachability rather than DNS resolution itself, and FortiGuard may not answer ICMP. It tempts as a familiar connectivity check, but the required command queries the resolver directly and reports the resolved address.
C
get system dns
Why it fails: Running get system dns displays the FortiGate's configured DNS servers, not a live query, so it cannot confirm FortiGuard name resolution. It is tempting because it verifies DNS configuration, and would suit checking which resolvers are set, but the stem requires an actual lookup, which execute ping or execute nslookup performs.
D
diagnose test resolv [hostname]
Why it fails: Incorrect. This diagnostic syntax is invalid.

Full breakdown with real-world context →

Question 3hardmultiple choice

Read the full VPN explanation →

An administrator is troubleshooting a certificate validation error when users connect to an SSL VPN portal. Where can the active SSL VPN server certificate be verified or changed in the web-based manager?

A
VPN > SSL-VPN Settings (Server Certificate field)
The Server Certificate field under VPN > SSL-VPN Settings binds the certificate presented to portal users, so replacing or verifying it there resolves the validation error. This is the only GUI location where the active SSL VPN server certificate is assigned.
B
Policy & Objects > SSL Settings
Why it fails: Policy & Objects > SSL Settings configures portal and authentication options, not the server certificate bound to the SSL VPN. It is tempting because SSL-related settings logically appear there; the active certificate is verified and replaced under VPN > SSL-VPN Settings, where the server certificate is selected.
C
System > Certificates > SSL-VPN
Why it fails: System > Certificates lists and imports certificates but does not bind one to the SSL VPN service. It is tempting because the certificate itself lives there and can be inspected; changing the active SSL VPN server certificate happens under VPN > SSL-VPN Settings, where the portal's certificate is assigned.
D
Security Fabric > VPN Settings
Why it fails: Security Fabric > VPN Settings covers fabric-wide VPN configuration, not the SSL VPN portal's server certificate. It is tempting because it aggregates VPN-related options in one place; the active certificate is verified and changed under VPN > SSL-VPN Settings, where the portal's server certificate is selected.

Full breakdown with real-world context →

Question 4hardmultiple choice

Review the full routing breakdown →

An administrator needs to troubleshoot a routing issue and verify which route will be selected by the FortiGate for a specific destination IP. Which CLI command allows routing lookup simulation?

A
diagnose ip route lookup [dest-IP]
The diagnose ip route lookup command simulates the routing decision for a given destination IP, showing the matched route, outgoing interface and gateway without sending traffic. This directly satisfies the requirement to verify which route the FortiGate would select.
B
show routing-table match [dest-IP]
Why it fails: 'show routing-table match' is not valid FortiOS syntax; the routing table is inspected with 'get router info routing-table', which lacks a match simulation argument. It is tempting because 'show' commands display configuration and status, and would be correct for viewing interface or firewall settings rather than simulating a lookup.
C
get router route-check [dest-IP]
Why it fails: 'get router route-check' does not exist in FortiOS; route lookup simulation uses 'get router info routing-table details <dest-IP>'. It is tempting because 'get router' prefixes many valid diagnostic commands, and such commands would be correct for reading the current routing table rather than simulating selection for a destination.
D
execute route-test [dest-IP]
Why it fails: FortiGate has no 'execute route-test' command; the routing lookup simulation is performed with 'get router info routing-table details' or the diagnose command, so this syntax fails. It is tempting because 'execute' commands do exist for pinging and tracing, which would suit connectivity testing rather than route selection.

Full breakdown with real-world context →

Question 5mediummultiple choice

Full question →

An administrator notices that a FortiGate high availability (HA) cluster has experienced a failover. Which log category on the FortiGate or FortiAnalyzer should the administrator check to investigate the cause of the HA state transition?

A
Event logs (System Event logs)
System Event logs record HA state transitions, including the reason for failover such as heartbeat loss, link failure or monitored-interface down. This satisfies the stem's requirement to investigate the cause of the HA state transition rather than examining traffic or attack logs.
B
Antivirus quarantine logs
Why it fails: Antivirus quarantine logs list files isolated after malware detection, which never capture HA heartbeat or failover transitions. They are the correct category when investigating which infected files were quarantined and what action the antivirus profile took.
C
Web filtering browsing logs
Why it fails: Web filtering logs record HTTP and HTTPS browsing activity categorised by policy, with no HA state or failover events. They are the right place to investigate blocked or allowed website access and category-based policy enforcement.
D
DHCP lease assignment logs
Why it fails: DHCP lease logs record address assignments to clients, containing nothing about HA heartbeat, link, or synchronisation state changes. They are the correct source when investigating address allocation failures or scope exhaustion on a FortiGate interface.

Full breakdown with real-world context →

Question 6hardmultiple choice

Full question →

An administrator needs to review the exact CLI commands executed during a troubleshooting session or audit log history. Which log category records administrative CLI command execution?

A
Security Fabric > Audit Logs
Why it fails: Security Fabric > Audit Logs covers Fabric topology and device events, not administrative CLI command execution, which resides in Log & Report > Audit Logs. It tempts because the word audit suggests command history, but this location records Fabric-level activity instead of per-administrator CLI entries.
B
FortiView > Command History
Why it fails: FortiView provides graphical traffic and threat visualisation dashboards, not administrative command records, so it cannot show executed CLI commands. It tempts because FortiView aggregates logged activity into drill-down views, which feels like an audit trail, yet command execution is captured only in Audit Logs.
C
Log & Report > System Events (Admin Login and CLI Command Logs)
Log & Report > System Events captures administrative CLI command execution through the Admin Login and CLI Command Logs sub-category, recording each command an administrator runs on the FortiGate. This directly satisfies the requirement to review exact CLI commands executed during a troubleshooting session or audit history, unlike traffic or event logs that omit command-level detail.
D
Log & Report > CLI History
Why it fails: CLI History does not exist under Log & Report; administrative command execution is recorded in the Audit Logs, not the log category tree. It tempts because Log & Report hosts event, traffic and security logs, so an administrator expects command records there, but no such CLI-specific log category is present.

Full breakdown with real-world context →

Question 7hardmultiple choice

Full question →

An administrator is troubleshooting a packet loss issue and needs to inspect the kernel buffer drops and interface error counters. Which CLI command provides a summary of interface drop statistics?

A
execute interface-test drops
Why it fails: `execute interface-test drops` runs an active diagnostic test that injects traffic to probe interface behaviour, so it cannot report the kernel buffer drops and error counters already accumulated on the interface. It is tempting because interface-test commands do exist for fault isolation, and would suit confirming suspected hardware faults after reviewing statistics.
B
diagnose hardware deviceinfo nic [interface]
`diagnose hardware deviceinfo nic` queries the network interface driver directly, reporting kernel-level buffer drops alongside interface error counters such as RX/TX errors and overruns. This satisfies the stem's requirement to inspect kernel buffer drops and interface error counters in one summary view.
C
show interface drops
Why it fails: 'show interface drops' is not a valid FortiOS command; interface error and drop counters are viewed with 'diagnose hardware deviceinfo nic' or 'get system interface physical'. It tempts because the wording matches the question, but the syntax does not exist.
D
get system drop-stats
Why it fails: 'get system drop-stats' does not exist in FortiOS; kernel buffer drops are inspected with 'diagnose netlink interface list' or 'diagnose hardware deviceinfo nic'. It tempts because it sounds like a drop-statistics command, but the actual diagnostic syntax differs.

Full breakdown with real-world context →

Question 8hardmultiple choice

Read the full DHCP explanation →

An administrator is troubleshooting a DHCP server issue on the FortiGate and needs to see active IP address leases assigned by the built-in DHCP server. Which CLI command provides this information?

A
execute dhcp lease-list
The execute dhcp lease-list command queries the FortiGate's built-in DHCP server and returns currently active leases with IP, MAC and expiry details. It directly satisfies the requirement to view active IP address leases assigned by the built-in server.
B
diagnose system dhcp list
Why it fails: This command lists DHCP scope configuration and pool parameters, not the active lease bindings the administrator needs. It is tempting because its name suggests lease enumeration, and it would be the right choice when verifying scope settings or address ranges rather than inspecting which clients currently hold leases.
C
get router info dhcp
Why it fails: This queries the routing table for DHCP-derived routes, not the built-in server's lease database, so no client bindings appear. It is tempting because it is a genuine DHCP diagnostic command, and it would be correct for checking addresses learned from an upstream DHCP server via the interface, not local leases.
D
get system dhcp-server lease
Why it fails: This command displays lease information held by the FortiGate's own DHCP server, but the administrator needs the leases currently assigned and active. It would be correct for inspecting the server's configured lease database rather than the live lease list shown by the execute command.

Full breakdown with real-world context →

Question 9mediummultiple choice

Full question →

An administrator is troubleshooting intermittent latency on a specific interface. They need to capture live packet data passing through that interface directly from the FortiGate CLI. Which command is used for packet capture?

A
execute ping-packet
Why it fails: execute ping-packet is not a FortiGate packet-capture command; it does not mirror live frames from an interface. It is tempting because the name suggests packet handling, and it would be correct for testing reachability to a host rather than capturing traffic.
B
execute trace-route
Why it fails: execute trace-route maps the path packets take to a destination; it does not capture live frames on an interface. It is tempting because it is a diagnostic command, and it would be correct for locating a routing hop failure rather than recording packet data.
C
get system interface traffic
Why it fails: get system interface traffic displays interface counters and statistics, not captured packet payloads. It is tempting because it reports traffic on the named interface, and it would be correct for checking throughput or error counts rather than inspecting live frames.
D
diagnose sniffer packet
The diagnose sniffer packet command captures live packets at the interface level from the CLI, letting the administrator inspect traffic on the specific interface. It directly satisfies the requirement to capture live packet data without external tools.

Full breakdown with real-world context →

Question 10hardmultiple choice

Full question →

An administrator is troubleshooting a scenario where internal users can browse safe websites, but HTTPS inspection using certificates is throwing browser security warnings for certain internal web applications. What is the most likely cause of this behavior when using Deep Packet Inspection (DPI) on FortiGate?

A
The Web Filtering license on the FortiGate has expired, causing HTTPS inspection to fail open.
Why it fails: An expired Web Filtering licence disables category-based blocking and FortiGuard lookups, but HTTPS inspection itself continues using the local CA certificate; browsers warn because they distrust that certificate, not because licensing lapsed. The licence matters when URL filtering categories must be enforced.
B
The firewall policy is configured with proxy-based inspection instead of flow-based inspection.
Why it fails: Proxy-based inspection terminates the TLS session and re-signs with the FortiGate CA, so browsers trust it only if that CA is installed; the scenario's warnings on internal apps point to certificate trust, not inspection mode. Flow-based inspection is chosen for throughput, not to prevent warnings.
C
The Antivirus database update failed, preventing the FortiGate from decrypting TLS 1.3 handshakes.
Why it fails: Antivirus database updates are unrelated to TLS decryption; deep inspection uses the FortiGate's certificate and CA chain, so browser warnings arise when the inspection CA is not trusted by the client or the certificate is mismatched. It is tempting because update failures do cause inspection problems, but not certificate trust errors.
D
The FortiGate CA certificate has not been installed in the trusted root certificate store of the client endpoints.
HTTPS inspection requires FortiGate to re-sign traffic with its own CA certificate. If that CA is absent from each endpoint's trusted root store, browsers cannot chain the forged certificate to a trusted authority, so they raise security warnings for the internal web applications.

Full breakdown with real-world context →

Question 11hardmulti select

Read the full network assurance explanation →

An administrator is troubleshooting log delivery failures to a remote syslog server. Which TWO troubleshooting commands or tools can be used from the FortiGate CLI to verify connectivity and log transmission?

A
diagnose debug flow filter
Why it fails: Used for debugging firewall policy traffic matching, not syslog application layer packets.
B
execute factory-reset
Why it fails: Destroys the configuration and does not help troubleshoot logs.
C
get system arps
Why it fails: Displays ARP cache, which does not directly test log transmission or application connectivity.
D
execute ping <syslog-server-ip>
The execute ping command tests ICMP reachability to the syslog server, confirming whether routing, firewall policy or upstream connectivity is blocking traffic. It satisfies the requirement to verify connectivity from the FortiGate CLI before assuming the logging daemon itself is at fault.
E
diagnose sniffer packet any 'port 514' 4
The sniffer captures live packets on UDP or TCP port 514, confirming whether syslog traffic actually leaves the FortiGate and reaches the remote server. This directly satisfies the stem's requirement to verify log transmission, exposing drops, wrong destinations or filtering that `execute log filter` alone cannot reveal.

Full breakdown with real-world context →

Question 12mediummultiple choice

Full question →

A network administrator is troubleshooting an intermittent connectivity issue on a FortiGate 100F running FortiOS 7.2. They suspect that the problem is related to the session table filling up. Which CLI command should they use to view the current session count and the maximum session limit?

A
get system session status
Why it fails: This is not a valid FortiOS command. The correct command family for session information is 'diagnose sys session'. Using an invalid command will return an error and not provide the needed session statistics, wasting time during troubleshooting.
B
show system session info
Why it fails: This command does not exist in FortiOS. Session information is accessed via 'diagnose' commands. Attempting to use this command will fail and not show the session count or limit, so it cannot help diagnose the issue.
C
diagnose sys session stat
This command displays statistics about the session table, including the current number of sessions and the maximum session limit. It is the correct tool to quickly assess session table utilization and determine if the table is near capacity, which could cause new sessions to be dropped and lead to intermittent connectivity issues.
D
diagnose netlink session list
Why it fails: This command is not a standard FortiOS command for viewing session statistics. While 'diagnose netlink' commands exist for low-level interface information, they do not provide session table counts. Using this would not yield the required session utilization data.

Full breakdown with real-world context →

These FORTINET-NSE123 practice questions are part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style FORTINET-NSE123 questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.

Troubleshooting Scenario Questions

How to approach troubleshooting scenario questions

Quick answer

Related FORTINET-NSE123 topic practice pages

Nse 3 Fortigate Operational Fundamentals practice questions

Nse 1 Foundational Cybersecurity Concepts practice questions

Nse 2 Technical Introduction TO Fortinet Security practice questions

FORTINET-NSE123 fundamentals practice questions

FORTINET-NSE123 scenario practice questions

FORTINET-NSE123 troubleshooting practice questions

Practice scenarios

An administrator is troubleshooting high memory utilization on a FortiGate. They run 'get system performance status' and see that memory usage is in conserve mode. What immediate action does FortiOS take when entering conserve mode?

An administrator needs to test DNS resolution directly from the FortiGate command line interface to troubleshoot a FortiGuard connectivity issue. Which command should be used?

An administrator is troubleshooting a certificate validation error when users connect to an SSL VPN portal. Where can the active SSL VPN server certificate be verified or changed in the web-based manager?

An administrator needs to troubleshoot a routing issue and verify which route will be selected by the FortiGate for a specific destination IP. Which CLI command allows routing lookup simulation?

An administrator notices that a FortiGate high availability (HA) cluster has experienced a failover. Which log category on the FortiGate or FortiAnalyzer should the administrator check to investigate the cause of the HA state transition?

An administrator needs to review the exact CLI commands executed during a troubleshooting session or audit log history. Which log category records administrative CLI command execution?

An administrator is troubleshooting a packet loss issue and needs to inspect the kernel buffer drops and interface error counters. Which CLI command provides a summary of interface drop statistics?

An administrator is troubleshooting a DHCP server issue on the FortiGate and needs to see active IP address leases assigned by the built-in DHCP server. Which CLI command provides this information?

An administrator is troubleshooting intermittent latency on a specific interface. They need to capture live packet data passing through that interface directly from the FortiGate CLI. Which command is used for packet capture?

An administrator is troubleshooting log delivery failures to a remote syslog server. Which TWO troubleshooting commands or tools can be used from the FortiGate CLI to verify connectivity and log transmission?

A network administrator is troubleshooting an intermittent connectivity issue on a FortiGate 100F running FortiOS 7.2. They suspect that the problem is related to the session table filling up. Which CLI command should they use to view the current session count and the maximum session limit?