NSE7 SIP ALG Practice Question
An administrator is troubleshooting a scenario where VoIP traffic is not being properly handled by the FortiGate. The SIP ALG is enabled. Which THREE commands should the administrator run to diagnose the SIP traffic flow?
⚠ Common exam trap
Candidates often focus only on session and debug commands, overlooking the importance of verifying the routing table to ensure SIP packets can reach their destination. The correct set includes all three: routing check, session filter, and debug.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
get router info routing-table all
To diagnose SIP traffic flow with SIP ALG enabled on FortiGate, the administrator should use three key commands. Option A: `get router info routing-table all` checks the routing table to ensure that SIP packets have a valid path to their destination. Option B: `diagnose sys session filter dport 5060` filters the session table to display only sessions using destination port 5060 (default SIP signaling port), allowing verification that SIP sessions are being tracked. Option C: `diagnose debug application sip -1` enables verbose debug logging for the SIP application, providing detailed information about how the SIP ALG processes each SIP packet, including parsing, rewriting, and errors. Together, these commands help identify routing issues, session tracking, and SIP ALG processing problems.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
get router info routing-table all
Why this is correct
Correct. This command shows the routing table, which is essential to verify that the FortiGate has a valid route for SIP traffic to reach its destination. Without proper routing, SIP packets may be dropped or misrouted.
- ✓
diagnose sys session filter dport 5060
Why this is correct
Correct. Filters the session table to show only sessions using destination port 5060 (SIP signaling), allowing verification that SIP sessions are being tracked by the FortiGate.
- ✓
diagnose debug application sip -1
Why this is correct
Correct. Enables verbose debug logging for the SIP application, providing detailed information about how the SIP ALG processes each SIP packet, including parsing, rewriting, and errors.
- ✗
diagnose debug application sip -1
Why it's wrong here
Incorrect. This is a duplicate of option C; running the same command twice does not provide additional diagnostic value.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 940 original NSE7 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.