The answer is a large volume of traffic being inspected by IPS, often due to a DoS attack. The ipsengine process is responsible for Intrusion Prevention System deep packet inspection, and when it consumes high CPU on a FortiGate, it indicates that the device is overwhelmed by the computational load of matching traffic against IPS signatures. This is a core concept tested on the Fortinet NSE 7 Advanced Security NSE7 exam, where you must distinguish between normal IPS processing and an abnormal spike caused by a surge in traffic, such as a DoS attack. A common trap is to blame a misconfigured firewall policy or a hardware failure, but the key is that ipsengine specifically handles signature-based inspection, not routing or NAT. Remember the memory tip: "IPS eats CPU when traffic is deep and steep"—if the CPU is high and ipsengine is the culprit, look for a flood of traffic requiring deep inspection.
NSE7 Troubleshooting and Diagnostics Practice Question
This NSE7 practice question tests your understanding of troubleshooting and diagnostics. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A FortiGate is experiencing high CPU usage. The administrator runs 'diagnose sys top' and sees that the process 'ipsengine' is using the most CPU. What is the most likely cause?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue: "most likely"
Why it matters: Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A large volume of traffic is being inspected by IPS, possibly due to a DoS attack.
The ipsengine process handles Intrusion Prevention System (IPS) inspection. High CPU usage by ipsengine typically indicates that the FortiGate is processing a large volume of traffic through IPS signatures, which is computationally intensive. This is often triggered by a DoS attack or a sudden surge in traffic that requires deep packet inspection, overwhelming the CPU.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
The firewall is experiencing a memory leak.
Why it's wrong here
Memory leaks cause high memory usage, not necessarily high CPU by ipsengine.
✓
A large volume of traffic is being inspected by IPS, possibly due to a DoS attack.
Why this is correct
IPS engine uses CPU for deep packet inspection; high volume or many signatures increases load.
Clue confirmation
The clue word "most likely" in the question point toward this answer.
Related concept
Read the scenario before looking for a memorised answer.
✗
The antivirus engine is scanning large files.
Why it's wrong here
Antivirus uses a separate process, not ipsengine.
✗
There is a routing loop causing packet bouncing.
Why it's wrong here
Routing loops affect forwarding plane, not ipsengine.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates may confuse ipsengine with avengine or assume high CPU is always due to a memory leak, but the specific process name directly points to IPS inspection overload.
Detailed technical explanation
How to think about this question
IPS inspection on FortiGate uses pattern matching and protocol decoders to analyze traffic against a signature database. Under a DoS attack, the sheer number of packets can cause the ipsengine to consume 100% CPU, potentially leading to packet drops and session timeouts. The 'diagnose sys top' command shows process-level CPU usage, and the 'ipsengine' process is distinct from other security engines like 'avengine' (antivirus) or 'wfengine' (web filtering).
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A small business has 20 workstations on the 192.168.1.0/24 network and one public IP from its ISP. The router uses PAT (NAT overload) so all 20 devices share one public address using different source ports. NAT questions test whether you understand the four address terms and which direction each translation applies.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Troubleshooting and Diagnostics — This question tests Troubleshooting and Diagnostics — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: A large volume of traffic is being inspected by IPS, possibly due to a DoS attack. — The ipsengine process handles Intrusion Prevention System (IPS) inspection. High CPU usage by ipsengine typically indicates that the FortiGate is processing a large volume of traffic through IPS signatures, which is computationally intensive. This is often triggered by a DoS attack or a sudden surge in traffic that requires deep packet inspection, overwhelming the CPU.
What should I do if I get this NSE7 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Are there clue words in this question I should notice?
Yes — watch for: "most likely". Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A network administrator runs 'diagnose sys top' and sees that the 'ipsengine' process is consistently using 99% CPU. What is the BEST immediate action to reduce CPU load?
easy
A.Reboot the FortiGate
B.Increase the session limit
✓ C.Disable IPS inspection on policies that don't require it
D.Change IPS engine to flow-based mode
Why C: Option B is correct because disabling IPS inspection will stop the IPS engine from processing traffic, thus reducing CPU load. Option A would not help if the issue is CPU load. Option C might help but is less direct. Option D is not relevant.
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.