The answer is to use the `diag sniffer packet any "host 10.0.1.0/24" 4` command as the most efficient first step for FortiGate packet drop troubleshooting. This command captures packets at the kernel level, before firewall policy processing, giving you immediate visibility into whether traffic from the specific subnet is even reaching the FortiGate and where it gets dropped—such as by reverse-path forwarding checks, session helpers, or DoS policies. On the Fortinet NSE 7 Advanced Security NSE7 exam, this tests your understanding of low-level diagnostics versus relying on logs or policy checks, which can miss pre-firewall drops. A common trap is to jump to `diagnose debug flow` or check logs first, but those only show post-policy decisions; the sniffer reveals drops before session creation. Memory tip: think "Sniffer first, debug later"—the sniffer shows the raw packet path, while debug flow confirms policy hits after the fact.
NSE7 Troubleshooting and Diagnostics Practice Question
This NSE7 practice question tests your understanding of troubleshooting and diagnostics. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A FortiGate administrator notices that traffic from a specific subnet is being dropped unexpectedly. The security policy allows the traffic, and there are no firewall policies blocking it. What is the most efficient first step to identify the cause of the drops?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue: "first"
Why it matters: Order matters here. You are being tested on which action comes before the others — not which action is generally useful.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use the 'diag sniffer packet any "host 10.0.1.0/24" 4' command to capture packets and analyze where they are dropped.
The 'diag sniffer packet any "host 10.0.1.0/24" 4' command captures packets at the kernel level before firewall processing, allowing you to see if traffic is reaching the FortiGate and where it is being dropped (e.g., due to reverse-path forwarding, session helper, or DoS policies). This is the most efficient first step because it provides immediate, low-level visibility into packet drops without requiring configuration changes or waiting for logs.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✓
Use the 'diag sniffer packet any "host 10.0.1.0/24" 4' command to capture packets and analyze where they are dropped.
Why this is correct
Packet sniffer with filter can capture the actual packets and show the drop reason in the output.
Clue confirmation
The clue word "first" in the question point toward this answer.
Related concept
Read the scenario before looking for a memorised answer.
✗
Run 'diagnose debug flow' with the source IP and look for 'no matching policy' or 'dropped' messages.
Why it's wrong here
Debug flow is useful but may not show drops that occur before policy matching, such as route issues.
✗
Enable 'deny-log' on all policies and check logs for the subnet.
Why it's wrong here
If traffic is not matched by any policy, deny-log won't capture it.
✗
Enable global traffic logging and review logs after some traffic passes.
Why it's wrong here
Global logging may generate excessive logs and not pinpoint the issue quickly.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates often jump to 'diagnose debug flow' as the default troubleshooting tool, but it only works after a session is created, missing pre-session drops that the sniffer can immediately expose.
Trap categories for this question
Command / output trap
Debug flow is useful but may not show drops that occur before policy matching, such as route issues.
Detailed technical explanation
How to think about this question
Under the hood, the FortiGate's packet flow involves multiple drop points before security policy evaluation: the NPU (network processor) can drop packets due to session mismatch, the kernel performs reverse-path forwarding (RPF) checks, and DoS-policy or session-helper errors can silently discard packets. The sniffer command with filter 'host 10.0.1.0/24' captures at the kernel interface, showing packets that enter and exit, allowing you to identify if the drop occurs at ingress, egress, or during forwarding (e.g., no ARP reply). In a real-world scenario, a common cause is asymmetric routing where RPF drops the packet, which the sniffer reveals as an incoming packet with no corresponding outgoing packet.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A small business has 20 workstations on the 192.168.1.0/24 network and one public IP from its ISP. The router uses PAT (NAT overload) so all 20 devices share one public address using different source ports. NAT questions test whether you understand the four address terms and which direction each translation applies.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Troubleshooting and Diagnostics — This question tests Troubleshooting and Diagnostics — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Use the 'diag sniffer packet any "host 10.0.1.0/24" 4' command to capture packets and analyze where they are dropped. — The 'diag sniffer packet any "host 10.0.1.0/24" 4' command captures packets at the kernel level before firewall processing, allowing you to see if traffic is reaching the FortiGate and where it is being dropped (e.g., due to reverse-path forwarding, session helper, or DoS policies). This is the most efficient first step because it provides immediate, low-level visibility into packet drops without requiring configuration changes or waiting for logs.
What should I do if I get this NSE7 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Are there clue words in this question I should notice?
Yes — watch for: "first". Order matters here. You are being tested on which action comes before the others — not which action is generally useful.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.