NSE7 Troubleshooting and Diagnostics Practice Question
An administrator runs 'diagnose debug application ssl-helper -1' and sees that sessions to certain HTTPS sites are being terminated by the FortiGate. What is the MOST likely cause?
⚠ Common exam trap
Watch out — candidates often confuse 'certificate-inspection' with 'deep inspection' and assume certificate mismatches cause TCP RSTs, but in certificate-inspection mode the FortiGate does not terminate the SSL handshake—it only inspects the certificate without decrypting, so no RST injection occurs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The FortiGate is performing TCP RST injection due to a mismatch in the SSL/TLS handshake as part of deep inspection
The 'diagnose debug application ssl-helper -1' command shows SSL helper events, including TCP RST injection. When deep inspection is enabled and the FortiGate cannot complete the SSL/TLS handshake with the server (e.g., due to cipher mismatch, certificate validation failure, or unsupported protocol version), it sends a TCP RST to both the client and server to terminate the session. This is the most direct cause of sessions being terminated as observed in the debug output.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The FortiGate's certificate authority (CA) certificate has expired, causing SSL inspection to fail
Why it's wrong here
While an expired CA can cause inspection failures, the debug output specifically shows ssl-helper actions, not CA expiration errors.
- ✗
The antivirus profile is blocking the HTTPS connections due to a virus signature match
Why it's wrong here
Antivirus would block after inspection; the debug shows ssl-helper activity, not antivirus.
- ✓
The FortiGate is performing TCP RST injection due to a mismatch in the SSL/TLS handshake as part of deep inspection
Why this is correct
The ssl-helper process performs deep inspection by injecting RST packets when the handshake is invalid or certificate errors occur, causing session termination.
- ✗
The SSL deep inspection policy is set to 'certificate-inspection' which blocks sessions with mismatched certificates
Why it's wrong here
Certificate inspection does not block sessions based on mismatched certificates; it only extracts the certificate information.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 940 original NSE7 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.