NSE7 Troubleshooting and Diagnostics Practice Question
A FortiGate administrator uses FortiAnalyzer for log analysis and wants to identify all sessions that were blocked by a specific firewall policy ID 10. Which log filter should be applied?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Filter by 'policyid eq 10'
The correct filter to identify sessions from a specific policy in FortiAnalyzer is 'policyid eq 10'. This uses the proper field name 'policyid' and the 'eq' operator. Option B uses '==' which is invalid, and option C uses the incorrect field name 'policy_id'.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Filter by 'action eq block' and then manually look for policy 10
Why it's wrong here
Filtering by 'action eq block' shows all blocked sessions, but you would still need to manually filter for policy ID 10, which is inefficient and not the direct filter requested.
- ✗
Filter by 'policyid == 10'
Why it's wrong here
Incorrect because '==' is not a valid operator in FortiAnalyzer log filters. The correct operator is '=' (or 'eq').
- ✓
Filter by 'policyid eq 10'
Why this is correct
Correct. Using 'policy_id = 10' directly filters for all sessions handled by policy ID 10, including those blocked, using the accepted '=' operator.
- ✗
Filter by 'devid contains 10'
Why it's wrong here
Incorrect because 'devid contains 10' filters by device ID, not policy ID, and will not identify sessions blocked by policy 10.
Go deeper
Related to this question
About these practice questions
This NSE7 question is part of Courseiva's 940-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.