NSE7 Troubleshooting and Diagnostics Practice Question
A FortiGate administrator is troubleshooting a connectivity issue where users cannot access a web server behind the FortiGate from the internet. The administrator suspects that the virtual IP (VIP) configuration is incorrect. Which two commands should the administrator use to verify the VIP configuration and its associated firewall policy? (Choose two.)
⚠ Common exam trap
The trap here is assuming that a VIP alone is sufficient, but without a matching firewall policy, traffic will still be blocked.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
show firewall policy
The correct commands are 'show firewall vip' and 'show firewall policy'. The first displays the VIP configuration, ensuring the external IP and mapped IP are correct. The second shows the firewall policies, verifying that a policy exists to allow traffic to the VIP. Together, they allow the administrator to confirm both the VIP setup and the policy that permits access, which are both necessary for connectivity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
diagnose debug flow filter
Why it's wrong here
This command sets filters for debug flow tracing, which is used to capture live traffic and see how it is processed. While it can be part of troubleshooting, it does not directly show VIP configuration or policy configuration. It is a step to trace packets, but the administrator first needs to verify the configuration. This command is not the best choice for verifying VIP and policy settings.
- ✓
show firewall policy
Why this is correct
This command displays all firewall policies, including those that reference VIPs. By examining the policy list, the administrator can verify that there is a policy allowing traffic from the external interface to the VIP, and that the policy is placed correctly in the order. This is crucial because even a correctly configured VIP requires a matching policy to permit traffic. The output includes policy IDs, source/destination addresses, and services.
- ✗
diagnose firewall vip list
Why it's wrong here
This command does not exist in FortiOS. While it sounds like it could list VIPs, the correct command to view VIP configuration is 'show firewall vip'. Using an invalid command will result in an error and not provide the needed information. The administrator should rely on valid show commands for configuration verification.
- ✓
show firewall vip
Why this is correct
This command displays the configured virtual IPs, including their external IP, mapped IP, and port forwarding settings. It allows the administrator to verify that the VIP is correctly configured with the right external and internal addresses. This is essential for troubleshooting VIP-related connectivity issues. The output also shows the VIP name and associated interfaces, which helps in matching with firewall policies.
- ✗
diagnose firewall iprope list
Why it's wrong here
This command lists the IP rope entries, which are related to session helpers and not VIP configuration. It does not provide information about VIPs or firewall policies. The administrator should use show commands to inspect configuration. This command is not relevant for verifying VIP settings.
Go deeper
Related to this question
About these practice questions
This NSE7 question is part of Courseiva's 718-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Fortinet exam blueprint
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.