Troubleshooting practice questions

When troubleshooting a missing log issue in FortiAnalyzer, which CLI command is most useful for checking the status of the log database?

Trap 1: show system logs

This displays system events, not database status.

Trap 2: get log status

This is not the correct command.

Trap 3: get system status

This shows general system info.

A
show system logs
Why wrong: This displays system events, not database status.
B
get log status
Why wrong: This is not the correct command.
C
get system status
Why wrong: This shows general system info.
D
diagnose sql status
This verifies the SQL database health.

Question 2hardmultiple choice

You are troubleshooting a failed policy installation. Where can you view the detailed diff between the FortiManager policy database and the actual FortiGate running configuration?

Trap 1: Object Usage.

Object usage displays where objects are referenced.

Trap 2: FortiView.

FortiView is for traffic monitoring, not policy configuration.

Trap 3: Device Manager > Revision History.

Revision history stores snapshots but doesn't compare pre-install diffs.

A
Policy & Objects > Installation Preview.
The installation wizard provides a Preview option to view the diff.
B
Object Usage.
Why wrong: Object usage displays where objects are referenced.
C
FortiView.
Why wrong: FortiView is for traffic monitoring, not policy configuration.
D
Device Manager > Revision History.
Why wrong: Revision history stores snapshots but doesn't compare pre-install diffs.
E
System Settings > Task Monitor.
Why wrong: Task monitor shows status, not content diffs.

Question 3mediummultiple choice

You are troubleshooting a sync issue where a device shows 'Modified' status in the Device Manager. What is the most likely cause?

Trap 1: The FortiManager license has expired.

An expired license would prevent management entirely, not cause a 'Modified' status.

Trap 2: The FortiManager firmware is outdated.

Firmware version issues usually result in 'Connection' errors, not 'Modified' status.

Trap 3: The policy package was deleted.

Deleting a policy package would cause a 'Policy Package Mismatch' error.

A
The FortiManager license has expired.
Why wrong: An expired license would prevent management entirely, not cause a 'Modified' status.
B
The FortiManager firmware is outdated.
Why wrong: Firmware version issues usually result in 'Connection' errors, not 'Modified' status.
C
The policy package was deleted.
Why wrong: Deleting a policy package would cause a 'Policy Package Mismatch' error.
D
The configuration on the FortiGate was changed locally.
Local changes on the FortiGate trigger a 'Modified' status in FortiManager.

Question 4mediummultiple choice

You are troubleshooting a scenario where FortiADC is failing to perform health checks on a backend server. Which log should you prioritize to identify the specific reason for the health check failure?

Trap 1: Session Table Logs

Session logs track active user connections.

Trap 2: Application Traffic Logs

These log client-to-server traffic, not health monitor status.

Trap 3: Security Policy Logs

These track firewall or WAF policy hits.

A
System Event Logs
Health check status changes are logged under System Event logs.
B
Session Table Logs
Why wrong: Session logs track active user connections.
C
Application Traffic Logs
Why wrong: These log client-to-server traffic, not health monitor status.
D
Security Policy Logs
Why wrong: These track firewall or WAF policy hits.
E
SNMP Traps
Why wrong: SNMP traps are for monitoring, not granular troubleshooting logs.

Question 5easymulti select

Which TWO FortiAnalyzer tools help in troubleshooting connection issues?

Trap 1: Log View

Log view is for logs, not network diagnostics.

Trap 2: Report module

Reporting is not for connectivity.

Trap 3: FortiView map

Map is for geographic traffic data.

A
Log View
Why wrong: Log view is for logs, not network diagnostics.
B
Device Manager
Shows connectivity status.
C
CLI tools (ping, get sys status)
Command-line diagnostics.
D
Report module
Why wrong: Reporting is not for connectivity.
E
FortiView map
Why wrong: Map is for geographic traffic data.

Question 6hardmultiple choice

You are troubleshooting a scenario where an Event Handler is not triggering as expected. What is the most effective way to verify if the logs are matching the filter criteria defined in the handler?

Trap 1: Run a manual report

Reports use different engines and do not reflect real-time event triggers.

Trap 2: Rebuild the SQL database

Rebuilding is a last resort and does not validate specific filter logic.

Trap 3: Check the FortiAnalyzer system logs

System logs show health, not event logic mismatches.

A
Run a manual report
Why wrong: Reports use different engines and do not reflect real-time event triggers.
B
Use the 'Test' button in the Event Handler definition
The test tool allows you to validate the logic against existing logs.
C
Rebuild the SQL database
Why wrong: Rebuilding is a last resort and does not validate specific filter logic.
D
Check the FortiAnalyzer system logs
Why wrong: System logs show health, not event logic mismatches.

Question 7hardmultiple choice

You are troubleshooting a FortiADC health check. The health check is failing even though the server is up. What should you verify first?

Trap 1: The ADC management IP

Management connectivity is distinct from data path health checks.

Trap 2: Server RAM utilization

RAM utilization does not affect standard HTTP health checks.

Trap 3: The switch MTU

MTU issues affect throughput, not usually basic status checks.

A
The ADC management IP
Why wrong: Management connectivity is distinct from data path health checks.
B
Expected Response code in the Health Check object
If the server returns 200 OK but the health check expects 302, it will fail.
C
Server RAM utilization
Why wrong: RAM utilization does not affect standard HTTP health checks.
D
The switch MTU
Why wrong: MTU issues affect throughput, not usually basic status checks.