NSE7 Troubleshooting and Diagnostics Practice Question
A FortiGate administrator is troubleshooting high CPU usage. The administrator runs 'diagnose sys top' and sees that the 'ipsengine' process is consuming a large amount of CPU. Which action should the administrator take to reduce the CPU usage while maintaining security?
⚠ Common exam trap
The trap here is thinking that disabling IPS or enabling fail-open are acceptable trade-offs, but they weaken security; optimization is the better approach.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Review and optimize the IPS sensor configuration to reduce the number of signatures or adjust anomaly thresholds.
The ipsengine process handles IPS inspection. High CPU usage can be mitigated by optimizing the IPS sensor configuration, such as disabling signatures that are not relevant to the environment, reducing the number of policies with IPS enabled, or adjusting anomaly thresholds. This maintains security by keeping essential protections while reducing the processing load.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Disable IPS globally.
Why it's wrong here
Disabling IPS globally would reduce CPU usage but would also remove a critical security layer, leaving the network vulnerable to attacks. This is not a recommended action as it compromises security. The administrator should instead optimize IPS settings or exclude non-critical traffic.
- ✗
Adjust the IPS fail-open setting to enable fail-open.
Why it's wrong here
Enabling fail-open allows traffic to bypass IPS inspection when the IPS engine is overloaded, which reduces CPU load but at the cost of security. This is not ideal for maintaining security. It might be used as a temporary measure, but it is not the best action to balance CPU and security.
- ✗
Increase the FortiGate's memory allocation to the ipsengine process.
Why it's wrong here
FortiGate does not allow manual memory allocation adjustments for individual processes. The ipsengine process's resource usage is managed by FortiOS. Increasing memory would not directly reduce CPU usage and is not a supported action. The administrator should instead optimize the IPS configuration.
- ✓
Review and optimize the IPS sensor configuration to reduce the number of signatures or adjust anomaly thresholds.
Why this is correct
Optimizing the IPS sensor by removing unnecessary signatures, adjusting thresholds, or applying IPS only to relevant policies can significantly reduce CPU usage while still providing essential protection. This approach maintains security by focusing on the most critical threats and avoiding unnecessary inspection overhead.
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE7 question from scratch — 718 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Fortinet exam blueprint
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.