NSE7 Troubleshooting and Diagnostics Practice Question
Exhibit
Refer to the exhibit. ``` diagnose debug flow filter saddr 10.0.1.100 diagnose debug flow filter daddr 10.0.2.200 diagnose debug flow trace start 100 diagnose debug enable # Output: id=20085 trace_id=1 func=print_pkt_detail line=5757 msg="vd-root:0 received a packet from port1. src=10.0.1.100 dst=10.0.2.200 sport=12345 dport=80 proto=6" id=20085 trace_id=1 func=resolve_ip_tuple line=3485 msg="tuple: 10.0.1.100->10.0.2.200, vd=0" id=20085 trace_id=1 func=fw_pre_route_handler line=162 msg="no matching policy" id=20085 trace_id=1 func=run_fw_handler line=59 msg="packet dropped" ```
Based on the debug flow output, what is the reason the packet is dropped?
⚠ Common exam trap
Many exam-takers assume a packet drop is due to a missing route when the debug flow shows a policy drop, because they overlook that FortiGate processes routing before policies and the debug flow output explicitly indicates the stage where the drop occurred.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
There is no firewall policy that matches the traffic.
The debug flow output indicates that the packet was dropped because no firewall policy matched the traffic. In FortiGate, even if a valid route exists, the packet must be evaluated against firewall policies; if no policy permits the traffic based on source, destination, service, and interface, the packet is silently dropped. The debug flow will show a message like 'no matching policy' or 'deny by policy' in such cases.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The route to the destination is missing.
Why it's wrong here
No routing-related messages appear in the output.
- ✓
There is no firewall policy that matches the traffic.
Why this is correct
The message 'no matching policy' clearly states this.
- ✗
The packet has an invalid source IP address.
Why it's wrong here
The debug shows no validation issue with the source IP.
- ✗
The session table is full.
Why it's wrong here
Session table full would show a different error.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE7 question from scratch — 940 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.