NSE7 Advanced VPN and Zero Trust Practice Question
A FortiGate administrator notices that a VPN tunnel goes down and re-establishes every 30 minutes. The administrator checks the tunnel's phase1 and phase2 lifetimes. The phase1 lifetime is set to 86400 seconds and phase2 to 3600 seconds. What is the most likely cause of the tunnel dropping?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The DPD (Dead Peer Detection) timeout is triggered every 30 minutes
The VPN tunnel drops every 30 minutes, which matches a typical DPD (Dead Peer Detection) timeout interval. DPD is used to verify that the remote peer is still reachable; if no response is received within the DPD timeout (default often 30 minutes), the tunnel is torn down. The phase2 lifetime of 3600 seconds (1 hour) would cause rekey every hour, not 30 minutes. The phase1 lifetime of 86400 seconds (24 hours) is long. Therefore, the most likely cause is a DPD timeout triggering every 30 minutes, making option D correct.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The phase2 lifetime is set to 3600 seconds, causing rekey failures
Why it's wrong here
Phase2 rekey happens every hour, not 30 minutes. Rekey failures would cause the tunnel to drop at rekey time.
- ✗
The phase1 lifetime is too short, causing frequent renegotiation
Why it's wrong here
Phase1 lifetime is 86400 seconds (24 hours), which is long and not causing 30-minute drops.
- ✗
The VPN tunnel is not configured to use NAT traversal
Why it's wrong here
NAT-T is needed if behind NAT; missing it would cause immediate issues, not periodic drops.
- ✓
The DPD (Dead Peer Detection) timeout is triggered every 30 minutes
Why this is correct
If DPD retry timeout is set to a value that results in the peer being declared dead after 30 minutes, the tunnel will be torn down and re-established.
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE7 question from scratch — 940 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.