NSE7 Troubleshooting and Diagnostics Practice Question
An administrator is troubleshooting a FortiGate HA cluster that is experiencing frequent failovers. The administrator wants to verify the HA status and identify potential issues. Which TWO commands should the administrator use to gather relevant information? (Choose two.)
⚠ Common exam trap
The trap here is choosing debug commands that are too detailed or unrelated, instead of starting with basic status and synchronization checks.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
diagnose sys ha checksum show
To diagnose frequent HA failovers, the administrator should first check the overall HA status with 'get system ha status' to see which unit is primary and if there are any anomalies. Then, verifying configuration synchronization with 'diagnose sys ha checksum show' helps ensure both units have identical configurations, as mismatches can cause instability. These two commands provide a quick, non-intrusive overview of the cluster's health and are the standard first steps.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
diagnose sys session list
Why it's wrong here
This command lists firewall sessions, which is unrelated to HA status. While session information can be useful for other troubleshooting, it does not provide insight into HA cluster health, failover reasons, or synchronization status. It is not relevant to diagnosing HA failovers.
- ✗
execute ha manage 0
Why it's wrong here
This command is used to connect to the CLI of the other HA unit (unit 0 or 1). While it allows you to run commands on the other unit, it does not itself display HA status. It is a step to access the other unit, but the administrator would still need to run status commands there. It is not a direct diagnostic command for HA health.
- ✓
diagnose sys ha checksum show
Why this is correct
This command shows the HA checksum values for each unit, which are used to verify configuration synchronization. If checksums do not match, the cluster may be out of sync, potentially causing failovers or inconsistent behavior. It helps identify configuration discrepancies that could lead to HA instability.
- ✓
get system ha status
Why this is correct
This command displays the current HA status, including which unit is primary, the cluster uptime, and the status of each member. It also shows the HA mode and priority. It is essential for verifying the cluster's health and identifying if a unit is flapping or if there are communication issues.
- ✗
diagnose debug application hatalk -1
Why it's wrong here
This command enables debug output for the HA talk daemon, which handles heartbeat and synchronization. While it can be useful for deep troubleshooting, it is verbose and not typically the first step. It may also increase CPU load and is not a standard command for routine status checking. It is more appropriate after basic status commands indicate a problem.
Go deeper
Related to this question
About these practice questions
One of 718 original NSE7 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Fortinet exam blueprint
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.