Quick Answer
The answer is a process such as the IPS engine stuck in an infinite loop. This is the most likely cause because when CPU usage remains above 80% with no traffic, the system is not processing network packets; instead, a software process is consuming cycles in a tight, non-productive loop. The IPS engine is a common culprit due to known software bugs or process hangs that prevent it from yielding the CPU, which can be confirmed using the 'diagnose sys top' command to identify the offending PID. On the Fortinet NSE 4 Network Security Professional exam, this scenario tests your ability to distinguish between traffic-driven CPU spikes and process-level anomalies, a classic trap where candidates mistakenly suspect a DoS attack or misconfiguration. Remember the memory tip: "No traffic, high CPU? Look for a loop, not a flood."
This NSE4 practice question tests your understanding of system and network administration. The scenario asks you to isolate a root cause — eliminate options that address a different problem before choosing. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A FortiGate administrator is troubleshooting a high CPU usage issue. The 'get system performance status' command shows that the CPU usage is consistently above 80% with no traffic. Which of the following is the most likely cause?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue: "most likely"
Why it matters: Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.
An interface is in error-disable state causing CPU interrupts.
Why wrong: Error-disable typically affects forwarding, not CPU.
The firewall policy is misconfigured, causing packet drops.
Why wrong: Drops are handled in hardware, not CPU.
A DDoS attack is overwhelming the CPU.
Why wrong: DDoS would show traffic.
A process such as the IPS engine is stuck in an infinite loop.
A runaway process can consume CPU even without traffic.
Answer choices
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
A process such as the IPS engine is stuck in an infinite loop.
When CPU usage remains high (above 80%) with no traffic, the most likely cause is a process stuck in an infinite loop, such as the IPS engine. This is a known software bug or process hang that consumes CPU cycles even without network traffic, and it can be verified using 'diagnose sys top' to identify the offending process.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
For each option: why learners choose it and why it is or isn't the right answer here.
An interface is in error-disable state causing CPU interrupts.
Why it's wrong here
Error-disable typically affects forwarding, not CPU.
The firewall policy is misconfigured, causing packet drops.
Why it's wrong here
Drops are handled in hardware, not CPU.
A DDoS attack is overwhelming the CPU.
Why it's wrong here
DDoS would show traffic.
A process such as the IPS engine is stuck in an infinite loop.
Why this is correct
A runaway process can consume CPU even without traffic.
Clue confirmation
The clue word "most likely" in the question point toward this answer.
Related concept
Read the scenario before looking for a memorised answer.
Common exam traps
The trap here is that candidates often associate high CPU with external attacks or configuration errors, but the key clue 'with no traffic' eliminates those options, pointing instead to an internal process malfunction.
Trap categories for this question
Command / output trap
DDoS would show traffic.
Detailed technical explanation
The 'get system performance status' command shows overall CPU and memory utilization, but to pinpoint a stuck process, you must use 'diagnose sys top' to list running processes by CPU consumption. A process like the IPS engine can enter an infinite loop due to a memory corruption or a software defect, causing it to consume 100% of a single CPU core even without any traffic. This is often resolved by restarting the process (e.g., 'diagnose ips monitor restart') or upgrading the FortiOS firmware.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
A practitioner preparing for the NSE4 exam encounters this exact type of scenario on the job. The correct answer here is not the most general option — it is the best answer for the specific constraint described. Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option. Real exam questions reward reading the full scenario before eliminating options, because the constraint defines which answer fits.
What to study next
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
System and Network Administration — study guide chapter
Learn the concepts, then practise the questions
System and Network Administration practice questions
Targeted practice on this topic area only
All NSE4 questions
1,000 questions across all exam domains
Fortinet NSE 4 Network Security Professional NSE4 study guide
Full concept coverage aligned to exam objectives
NSE4 practice test guide
How to use practice tests most effectively before exam day
Related practice questions
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
Practise NSE4 questions linked to System and Network Administration.
Practise NSE4 questions linked to Firewall Policies and NAT.
Practise NSE4 questions linked to Authentication and VPN.
Practise NSE4 questions linked to Security Profiles.
Practise NSE4 questions linked to High Availability and Diagnostics.
Practise NSE4 questions linked to NSE4 fundamentals.
Practise NSE4 questions linked to NSE4 scenario.
Practise NSE4 questions linked to NSE4 troubleshooting.
Practice this exam
Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.
FAQ
System and Network Administration — This question tests System and Network Administration — Read the scenario before looking for a memorised answer..
The correct answer is: A process such as the IPS engine is stuck in an infinite loop. — When CPU usage remains high (above 80%) with no traffic, the most likely cause is a process stuck in an infinite loop, such as the IPS engine. This is a known software bug or process hang that consumes CPU cycles even without network traffic, and it can be verified using 'diagnose sys top' to identify the offending process.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Yes — watch for: "most likely". Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 11, 2026
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.