How many Troubleshooting Scenario Questions questions are on this page?

This page has 15 Troubleshooting Scenario Questions scenario questions for the NSE7 exam, each with detailed explanations and wrong-answer analysis.

How should I approach NSE7 scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to Fortinet NSE 7 Advanced Security NSE7 questions

Scenario-based practice

Troubleshooting Scenario Questions

Practise Fortinet NSE 7 Advanced Security NSE7 practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice test Read exam guide

scenario questions

NSE7

exam code

Fortinet

vendor

Scenario guide

How to approach troubleshooting scenario questions

These questions describe a network symptom and ask you to identify the root cause or the correct fix. They appear across all certification exams and reward systematic thinking over memorisation. The best candidates follow a consistent troubleshooting framework even under time pressure.

Quick answer

Troubleshooting Scenario Questions questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Practice scenarios

Question 1mediummulti select

Read the full VPN explanation →

A FortiGate administrator is troubleshooting an IKEv2 VPN tunnel that fails to establish. The remote peer logs show 'no acceptable proposal' error. Which TWO possible causes should the administrator check?

A
The remote peer's IP address is unreachable
Why wrong: Unreachability would cause timeout, not proposal rejection.
B
The phase1 encryption algorithm or integrity algorithm is mismatched
If the local and remote proposals do not have a common algorithm, negotiation fails with 'no acceptable proposal'.
C
The local FortiGate has the wrong IKE version configured
Why wrong: IKE version mismatch would cause a different error (e.g., 'no acceptable proposal' could appear if one side expects IKEv1 and the other IKEv2, but typically the error is more specific.
D
The remote peer's pre-shared key is incorrect
Why wrong: A pre-shared key mismatch causes authentication failure after proposal negotiation, not a proposal error.
E
The Diffie-Hellman group configured is not supported by both peers
DH group is part of the proposal; if mismatched, negotiation fails.

Full breakdown with real-world context →

Question 2easymultiple choice

Full question →

A FortiGate administrator is troubleshooting why a new firewall policy is not being applied to traffic. The policy has been created and installed via FortiManager. What is the quickest way to verify the current state of the policy on the FortiGate?

A
Use 'diagnose debug flow'
Why wrong: This is for detailed flow debugging, not quick verification.
B
Run 'execute fortimanager reindex'
Why wrong: This rebuilds the FortiManager index, not display policies.
C
Check FortiManager revision history
Why wrong: Revision history shows changes but not the current runtime state.
D
Run 'show firewall policy'
This shows the current policy configuration on the FortiGate.

Full breakdown with real-world context →

Question 3mediummultiple choice

Read the full VPN explanation →

A network administrator is troubleshooting an IPsec VPN tunnel that is not coming up. The configuration uses IKEv2 with pre-shared keys. The administrator runs 'diagnose vpn ike log-filter' and sees no logs. What is the most likely cause?

Question 4hardmulti select

Read the full VPN explanation →

A network engineer is troubleshooting an ADVPN scenario where shortcut tunnels between spokes are not forming. The hub has IKEv2 configured and the spokes are behind NAT. Which THREE conditions must be met for shortcut tunnels to establish?

A
NAT traversal is enabled on all gateways
Why wrong: NAT traversal is automatically enabled in IKEv2 when needed.
B
Spokes are configured with 'set auto-discovery' enabled
Spokes need auto-discovery to accept shortcut proposals.
C
IKEv1 is used for the spoke-to-hub tunnels
Why wrong: ADVPN requires IKEv2.
D
The hub's phase2 configuration has 'auto-negotiate' enabled
This allows the hub to propose shortcut tunnels.
E
The hub's phase2 configuration includes 'add-route'
This adds routes to spokes for shortcut.

Full breakdown with real-world context →

Question 5mediummultiple choice

Read the full VPN explanation →

A network administrator is troubleshooting an IPsec VPN tunnel between two FortiGates. The tunnel is up but traffic is not passing. The administrator runs 'diagnose vpn ike gateway list' and sees that the IKE SA has been established. However, 'diagnose vpn tunnel list' shows no IPsec SA entries. What is the most likely cause?

A
The firewall policies are not configured to allow traffic through the tunnel
Why wrong: Traffic would still create an IPsec SA when trigger matches; policies affect traffic flow after SA is established.
B
The phase 2 proposal (encryption, authentication, etc.) does not match between peers
Phase 2 negotiations fail if the proposal is mismatched, leading to no IPsec SA.
C
The pre-shared key on both sides does not match
Why wrong: Mismatched PSK would prevent IKE phase 1 from completing.
D
The interface MTU is set too low
Why wrong: Low MTU may cause fragmentation issues but would not prevent IPsec SA creation.

Full breakdown with real-world context →

Question 6mediummultiple choice

Read the full VPN explanation →

A FortiGate VPN administrator is configuring IKEv2 with certificate-based authentication using a PKI. The administrator has imported the CA certificate and the local certificate onto the FortiGate. When initiating the VPN, the tunnel fails to establish. The CLI log shows 'IKEv2 authentication failed' and 'certificate validation failure'. What is the most likely missing configuration?

A
The IKEv2 proposal includes an incompatible encryption algorithm
Why wrong: Proposal mismatch would cause 'no proposal chosen', not certificate validation failure.
B
The local certificate is not associated with the phase1 interface
Why wrong: The local certificate must be set, but the error indicates peer certificate validation failure, not local certificate issue.
C
The remote peer's certificate is not signed by the imported CA
Why wrong: If the remote certificate is not signed by the CA, validation would fail, but the admin likely imported the correct CA; the issue might be that the CA is not used for validation.
D
The CA certificate is not configured for peer certificate validation
The phase1 must include a reference to the CA certificate (via 'set ca-cert' or 'set certificate-peer') to validate the peer's certificate. Without this, the FortiGate does not know which CA to trust.

Full breakdown with real-world context →

Question 7mediummulti select

Full question →

A network admin is troubleshooting why FortiGate's antivirus is not detecting a known malware sample. The sample is detected by other scanners. Which two checks should the admin perform? (Choose two.)

A
Verify that the FortiGuard Antivirus subscription is active
Without a valid subscription, signatures are not updated.
B
Check that the file is not excluded by a file filter
Why wrong: File filter would block the file, not cause missed detection.
C
Ensure the firewall policy is configured for proxy-based inspection
Why wrong: Both flow and proxy can detect known malware.
D
Check the antivirus database version against the latest available
An outdated database may miss recent malware.
E
Confirm that the antivirus profile has 'Scan on Delivery' enabled
Why wrong: Scan on Delivery is not a standard setting in FortiGate antivirus profiles.

Full breakdown with real-world context →

Question 8hardmultiple choice

Full question →

An organization has two FortiGate firewalls in an HA active-passive cluster. They notice that after a failover event, some users cannot access external resources. The administrator checks the HA configuration and finds that failover occurred correctly. What is the most likely cause of the connectivity issue?

A
VDOM links are not synchronized
If VDOM links are not synchronized, the backup unit may have incorrect link status, causing routing issues.
B
session-pickup is disabled
Why wrong: Disabling session-pickup would drop sessions but not prevent new connections.
C
HA override is enabled
Why wrong: HA override does not affect connectivity; it only controls priority.
D
Gratuitous ARP is disabled
Why wrong: Without gratuitous ARP, the network might not update MAC tables, but users could still connect after ARP timeout.

Full breakdown with real-world context →

Question 9mediummultiple choice

Review the full subnetting walkthrough →

A customer reports intermittent connectivity issues between two internal subnets separated by a FortiGate firewall. The traffic is allowed by the policy, but users experience timeouts during peak hours. Which troubleshooting step should you take first?

A
Run a packet sniffer on the FortiGate to capture traffic between the subnets.
Why wrong: Running a packet sniffer on the FortiGate captures raw traffic but does not diagnose the root cause of intermittent timeouts during peak hours, which is likely buffer exhaustion or session table overflow rather than a policy or packet-level fault. This step is tempting because sniffing is the default tool for verifying whether packets traverse the firewall correctly, and it would be correct if the issue were suspected to be a silent policy drop or asymmetric routing.
B
Check the session table for session limits and session congestion.
Peak hour timeouts often indicate session table exhaustion; checking this is the quickest diagnostic step.
C
Disable hardware acceleration on the FortiGate.
Why wrong: This could reduce performance and is not a first step in troubleshooting intermittent connectivity.
D
Configure SNAT on the policy to translate the source IP.
Why wrong: SNAT is not a troubleshooting step and may not resolve the issue.

Full breakdown with real-world context →

Question 10mediummultiple choice

Open the full BGP breakdown →

A network administrator is troubleshooting a BGP session between a FortiGate and an ISP router. The administrator runs 'get router info bgp summary' and sees that the BGP state is 'Active'. What does this state indicate?

Question 11mediummultiple choice

Read the full VPN explanation →

When troubleshooting an IPsec VPN phase 1 failure, you run 'diagnose vpn ike config' and see that the remote gateway IP address is incorrect. Which command is used to correct the peer IP configuration?

A
set psksecret <secret>
Why wrong: This sets the pre-shared key, not the peer IP.
B
execute vpn tunnel down <tunnel>
Why wrong: This tears down the tunnel, not configures peer IP.
C
config vpn ipsec phase1-interface edit <name> set remote-gw <ip>
This sets the remote gateway IP address.
D
set certificate <name>
Why wrong: This sets the local certificate, not peer IP.

Full breakdown with real-world context →

Question 12hardmultiple choice

Full question →

An administrator runs 'diagnose sys session list' and sees sessions with 'proto=6 proto_state=02' and a long duration. The administrator is troubleshooting why sessions are not being terminated after a policy change that should block the traffic. What does 'proto_state=02' indicate?

A
The session is in TIME_WAIT state
Why wrong: TIME_WAIT is typically proto_state=05.
B
The session is in SYN_SENT state, waiting for a SYN-ACK
Why wrong: SYN_SENT is proto_state=01.
C
The session is in established state (TCP connection active)
proto_state=02 means ESTABLISHED. Existing sessions are not affected by policy changes; they continue until timeout or explicit termination.
D
The session is in FIN_WAIT state, closing the connection
Why wrong: FIN_WAIT states have higher numbers like 03 or 04.

Full breakdown with real-world context →

Question 13hardmultiple choice

Review the full routing breakdown →

A FortiGate running FortiOS 7.2 has multiple VDOMs. The administrator notices that inter-VDOM routing between two VDOMs is not working. Configuration shows a firewall policy allowing the traffic, and the route table shows routes to the destination VDOM. What additional configuration is required?

A
Configure a static route with a gateway IP in the destination VDOM
Why wrong: Routes are needed, but the link must exist first.
B
Create a VDOM link interface pair and assign them to the respective VDOMs
Inter-VDOM routing requires a VDOM link (logical interface pair) connecting the VDOMs.
C
Assign an IP address to the VLAN interface on the source VDOM
Why wrong: IP addresses are needed but the fundamental link is missing.
D
Enable 'inter-vdom' under config system global
Why wrong: That setting enables VDOMs, not inter-VDOM routing.

Full breakdown with real-world context →

Question 14hardmultiple choice

Full question →

A FortiGate administrator is troubleshooting a ZTNA access proxy issue. The ZTNA rule is configured to require the tag 'AV_Installed' and 'OS_Updated'. Users with compliant devices are still denied access. The admin checks the ZTNA connection monitor and sees 'Tag mismatch'. What is the MOST likely cause?

A
The FortiGate does not have a valid PKI certificate for the ZTNA proxy
Why wrong: A certificate issue would cause TLS handshake failure, not tag mismatch.
B
The user is not authenticated via SAML
Why wrong: If authentication were the issue, the error would be about authentication, not tags.
C
The FortiClient EMS is not configured as an endpoint control source on the FortiGate
The FortiGate must have EMS configured under Security Fabric > External Connectors > Endpoint Control. Without this, it cannot retrieve and verify tags from EMS.
D
The ZTNA rule is using the wrong port number
Why wrong: Port mismatch would cause connection failure, not tag mismatch.

Full breakdown with real-world context →

Question 15hardmulti select

Full question →

A FortiGate administrator is troubleshooting why files are not being submitted to FortiSandbox for analysis. Which THREE conditions must be met for file submission to work? (Choose three.)

A
SSL inspection must be disabled for the policy
Why wrong: SSL inspection does not affect file submission.
B
The file type must be in FortiSandbox's supported list
Unsupported files are not submitted.
C
The antivirus profile must be in proxy-based inspection mode
Flow-based does not support file submission.
D
The FortiSandbox must be in inline scanning mode
Why wrong: Inline scanning is a mode, but file submission works in other modes too.
E
The FortiGate must have a valid FortiSandbox license
License is required for submission.

Full breakdown with real-world context →

These NSE7 practice questions are part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style NSE7 questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.

Troubleshooting Scenario Questions

How to approach troubleshooting scenario questions

Quick answer

Related NSE7 topic practice pages

Advanced Networking and SD-WAN practice questions

Advanced VPN and Zero Trust practice questions

Enterprise Firewall and VDOMs practice questions

Advanced Threat Protection practice questions

Troubleshooting and Diagnostics practice questions

NSE7 fundamentals practice questions

NSE7 scenario practice questions

NSE7 troubleshooting practice questions

Practice scenarios

A FortiGate administrator is troubleshooting an IKEv2 VPN tunnel that fails to establish. The remote peer logs show 'no acceptable proposal' error. Which TWO possible causes should the administrator check?

A FortiGate administrator is troubleshooting why a new firewall policy is not being applied to traffic. The policy has been created and installed via FortiManager. What is the quickest way to verify the current state of the policy on the FortiGate?

A network administrator is troubleshooting an IPsec VPN tunnel that is not coming up. The configuration uses IKEv2 with pre-shared keys. The administrator runs 'diagnose vpn ike log-filter' and sees no logs. What is the most likely cause?

A network engineer is troubleshooting an ADVPN scenario where shortcut tunnels between spokes are not forming. The hub has IKEv2 configured and the spokes are behind NAT. Which THREE conditions must be met for shortcut tunnels to establish?

A network admin is troubleshooting why FortiGate's antivirus is not detecting a known malware sample. The sample is detected by other scanners. Which two checks should the admin perform? (Choose two.)

A customer reports intermittent connectivity issues between two internal subnets separated by a FortiGate firewall. The traffic is allowed by the policy, but users experience timeouts during peak hours. Which troubleshooting step should you take first?

A network administrator is troubleshooting a BGP session between a FortiGate and an ISP router. The administrator runs 'get router info bgp summary' and sees that the BGP state is 'Active'. What does this state indicate?

When troubleshooting an IPsec VPN phase 1 failure, you run 'diagnose vpn ike config' and see that the remote gateway IP address is incorrect. Which command is used to correct the peer IP configuration?

An administrator runs 'diagnose sys session list' and sees sessions with 'proto=6 proto_state=02' and a long duration. The administrator is troubleshooting why sessions are not being terminated after a policy change that should block the traffic. What does 'proto_state=02' indicate?

A FortiGate running FortiOS 7.2 has multiple VDOMs. The administrator notices that inter-VDOM routing between two VDOMs is not working. Configuration shows a firewall policy allowing the traffic, and the route table shows routes to the destination VDOM. What additional configuration is required?

A FortiGate administrator is troubleshooting why files are not being submitted to FortiSandbox for analysis. Which THREE conditions must be met for file submission to work? (Choose three.)