NSE7 Troubleshooting and Diagnostics Practice Question
A FortiGate is experiencing high latency on traffic passing through it. The administrator suspects that asymmetric routing is occurring. Which TWO symptoms are indicative of asymmetric routing?
⚠ Common exam trap
Candidates often confuse asymmetric routing with general routing issues like ECMP (option A) or performance problems (option D), but the exam specifically tests the stateful firewall behavior where traffic arriving on different interfaces for the same session is the definitive symptom.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Traffic from the same source IP arrives on different interfaces for different sessions.
Asymmetric routing occurs when traffic from the same source IP takes different paths through the network, causing packets to arrive on different FortiGate interfaces for different sessions. This breaks stateful inspection because the firewall expects all packets of a session to traverse the same interface; when they don't, it can lead to session timeouts or dropped packets, manifesting as high latency.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The routing table shows multiple equal-cost paths to the same destination.
Why it's wrong here
ECMP can cause load sharing but not necessarily asymmetric routing issues.
- ✓
Traffic from the same source IP arrives on different interfaces for different sessions.
Why this is correct
This indicates that the return traffic may be arriving on a different interface than expected.
- ✗
Traffic matching a policy is logged as allowed but the application does not work.
Why it's wrong here
This could be due to many reasons, not specific to asymmetric routing.
- ✗
CPU usage is consistently above 90% during peak hours.
Why it's wrong here
High CPU has many causes, not specifically asymmetric routing.
- ✓
The firewall logs show TCP SYN packets but no corresponding SYN-ACK packets for the same session.
Why this is correct
Asymmetric routing can cause the SYN-ACK to take a different path, bypassing the firewall.
Quick reference
Asymmetric Encryption Algorithm Comparison
| Algorithm | Key Exchange | Signatures | Equivalent Security Key | Notes |
|---|---|---|---|---|
| RSA-3072 | Yes | Yes | 128-bit | Widely deployed; slow for bulk data |
| ECDSA P-256 | No | Yes | 128-bit | Fast signatures; standard TLS certs |
| ECDH / ECDHE | Yes | No | 128-bit | Perfect forward secrecy in TLS 1.3 |
| DH / DHE | Yes | No | 128-bit (3072-bit key) | Replaced by ECDHE in modern TLS |
| Ed25519 | No | Yes | ~128-bit | SSH keys, modern PKI |
Go deeper
Related to this question
About these practice questions
This NSE7 question is part of Courseiva's 940-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.