NSE7 Troubleshooting and Diagnostics Practice Question
An administrator configures a session helper for FTP on FortiGate. After enabling the helper, FTP clients can establish control connections but data transfers fail. What is the most likely cause?
⚠ Common exam trap
Many candidates assume enabling a session helper globally is sufficient, but FortiGate requires the helper to be explicitly enabled on the firewall policy that matches the traffic, otherwise the helper's inspection logic is never triggered for that session.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The session helper is not applied to the correct firewall policy or the traffic is not matching the helper
The session helper for FTP must be explicitly applied to the firewall policy that handles the FTP traffic. If the helper is enabled globally but not associated with the correct policy, or if the traffic does not match the policy (e.g., due to incorrect source/destination or service), the FortiGate will not inspect the control channel to dynamically open data ports. This results in successful control connections (TCP port 21) but failure of data transfers (active or passive), as the helper is not present to create the necessary pinholes for data sessions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The firewall policy is configured to deny all FTP traffic
Why it's wrong here
Control connection works, so policy allows FTP.
- ✗
The FTP server's certificate is invalid
Why it's wrong here
FTP does not use certificates for data transfer.
- ✗
The FTP server is using active mode, which is not supported by the session helper
Why it's wrong here
Session helpers support both active and passive FTP.
- ✓
The session helper is not applied to the correct firewall policy or the traffic is not matching the helper
Why this is correct
If the helper is not associated with the policy or the traffic doesn't match, the helper won't open data ports.
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE7 question from scratch — 940 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.