Courseiva
Advanced Networking and SD-WANmediumDrag & DropObjective-mapped

NSE7 Advanced Networking and SD-WAN Practice Question

Drag and drop the steps to troubleshoot a FortiGate SSL VPN connection failure into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

Basic configuration, then user authentication, then policies, then debug, then routing

Start with basic configuration, then user authentication, then policies, then debug, then routing.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • Basic configuration, then user authentication, then policies, then debug, then routing

    Why this is correct

    This is the correct order because troubleshooting should start with verifying basic SSL VPN settings (interface, port, certificate), then user authentication (user groups, authentication server), then firewall policies allowing SSL VPN traffic, then enabling debug to capture detailed logs, and finally checking routing to ensure traffic can flow correctly.

  • User authentication, then basic configuration, then policies, then debug, then routing

    Why it's wrong here

    This is incorrect because checking user authentication before verifying basic configuration can lead to wasted effort; if the SSL VPN interface or portal settings are wrong, authentication will fail regardless.

  • Basic configuration, then policies, then user authentication, then debug, then routing

    Why it's wrong here

    This is incorrect because policies rely on user authentication; if users are not properly authenticated, the policies will not match, so authentication must be verified before policies.

  • Basic configuration, then user authentication, then debug, then policies, then routing

    Why it's wrong here

    This is incorrect because enabling debug before policies are confirmed to be correct can generate excessive log data; it is more efficient to verify policies first to ensure traffic is permitted.

Quick reference

VPN Protocol Comparison

ProtocolPortEncryptionAuthenticationUse Case
IKEv2 / IPsecUDP 500 / 4500AES-256Certificates / PSKSite-to-site & remote access
SSL / TLS VPNTCP 443TLS 1.3Certificates / MFAClientless remote access
L2TP / IPsecUDP 1701AES (IPsec)PSK / CertificatesLegacy remote access
WireGuardUDP 51820ChaCha20Public keysModern high-performance VPN
PPTPTCP 1723MPPE (weak)MS-CHAPv2Legacy — avoid in production

PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.

About these practice questions

Courseiva writes every NSE7 question from scratch — 940 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.