NSE7 Troubleshooting and Diagnostics Practice Question
An admin needs to verify that a new firewall policy is performing SSL inspection. Which THREE CLI commands or steps should the admin use to confirm? (Choose three.)
⚠ Common exam trap
A common mix-up: candidates confuse 'diagnose debug flow' with confirming SSL inspection, but it only verifies policy matching, not the actual decryption process handled by the proxy.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use 'diagnose wad filter' to check if traffic is being processed by the web proxy for SSL inspection
'diagnose wad filter' is used to verify that traffic is being processed by the web proxy (WAD) for SSL inspection. When SSL inspection is enabled, traffic on port 443 is intercepted by the FortiGate's proxy, and this command filters and displays relevant proxy sessions, confirming that decryption is occurring.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use 'diagnose wad filter' to check if traffic is being processed by the web proxy for SSL inspection
Why this is correct
SSL inspection in proxy mode goes through the WAD daemon; checking WAD confirms inspection.
- ✗
Run 'diagnose debug flow' to check if traffic is hitting the policy
Why it's wrong here
Debug flow shows traffic matching but not necessarily SSL inspection status.
- ✓
Filter sessions with 'diagnose sys session filter dport 443' and list sessions to see if they are decrypted
Why this is correct
Decrypted sessions show additional information like 'decrypted' flag.
- ✗
Run 'get system performance status' to see SSL inspection statistics
Why it's wrong here
This shows general performance, not SSL inspection status for a specific policy.
- ✓
Check the policy configuration with 'show firewall policy <id>' and look for 'ssl-ssh-profile'
Why this is correct
Proper SSL inspection requires an SSL/SSH profile attached to the policy.
Visual reference
Go deeper
Related to this question
About these practice questions
This NSE7 question is part of Courseiva's 940-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.