NSE7 Troubleshooting and Diagnostics Practice Question
An administrator notices that after upgrading FortiOS, some traffic that was previously inspected by the antivirus profile is now bypassing scanning. The administrator suspects the session helper configuration may be interfering. Which TWO session helper protocols are known to potentially affect traffic inspection if improperly configured?
⚠ Common exam trap
Candidates often assume HTTP or TFTP are the culprits because they are common protocols, but the question specifically targets session helpers that manage dynamic port negotiation, which only FTP and SIP require among the options.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
FTP
FTP (File Transfer Protocol) uses separate control and data channels, and FortiGate's session helper dynamically opens pinholes for the data channel. If the FTP session helper is improperly configured or disabled, the antivirus scanner may not inspect the data channel traffic, allowing it to bypass scanning. This is a known issue when upgrading FortiOS if the session helper configuration is not migrated correctly.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
TFTP
Why it's wrong here
TFTP, as a connectionless UDP-based protocol, does not maintain session state that would cause FortiOS session helpers to bypass antivirus scanning after an upgrade; the issue described stems from helpers that alter how the firewall tracks application-layer streams, which TFTP does not do. It is tempting because TFTP is a known protocol requiring a session helper for dynamic port negotiation, and in a scenario where traffic inspection fails due to missing or misconfigured helpers for protocols like FTP or SIP, TFTP would be a correct choice.
- ✓
FTP
Why this is correct
FTP helper manages data channels; improper configuration can lead to inspection gaps.
- ✗
PPTP
Why it's wrong here
PPTP helper is less common and not known for causing inspection bypass.
- ✗
HTTP
Why it's wrong here
HTTP helper is commonly used and well-tested; it does not typically cause bypass.
- ✓
SIP
Why this is correct
SIP helper can open pinholes for media streams; if misconfigured, it may cause bypass of inspection.
Go deeper
Related to this question
About these practice questions
This NSE7 question is part of Courseiva's 940-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.