Knowledge + Practice

CCNA Nse7 Troubleshooting Questions

75 of 141 questions · Page 1/2 · Nse7 Troubleshooting topic · Answers revealed

Practice these questions Exam hub All questions

1

Multi-Selectmedium

An administrator is troubleshooting an IPsec VPN tunnel that establishes phase 1 but fails phase 2. Which TWO commands are MOST useful to diagnose the phase 2 failure? (Choose two.)

Select 2 answers

A.diagnose sys session list

B.show vpn ipsec phase2-interface

C.get system performance status

D.diagnose vpn ike config

E.diagnose debug application ike 255

AnswersD, E

Shows phase 2 proposals and selectors.

Why this answer

The 'diagnose vpn ike config' command (D) displays the IKE configuration that the FortiGate is actually using for phase 2 negotiations, including proxy IDs, encryption algorithms, and lifetimes. This helps identify mismatches between the local and peer configurations that cause phase 2 to fail. The 'diagnose debug application ike 255' command (E) enables verbose IKE debugging, which logs every phase 2 exchange, including error messages like 'no proposal chosen' or 'mismatched proxy ID', directly pinpointing the failure reason.

Exam trap

The trap here is that candidates often choose 'show vpn ipsec phase2-interface' (B) thinking it shows real-time negotiation status, but it only displays static configuration, not the dynamic debug output needed to see why the peer rejects the proposal.

Practice this question →

2

MCQmedium

A FortiGate is configured to send logs to FortiAnalyzer. The administrator notices that logs are not appearing on FortiAnalyzer. Running 'diagnose log device show' shows 'connected=no'. What is the most likely cause?

A.The log rate is too high and logs are being dropped

B.The FortiGate's log buffer is full

C.The FortiGate cannot reach the FortiAnalyzer due to a network issue

D.The FortiAnalyzer license has expired

AnswerC

Connectivity failure is the primary reason for 'connected=no'.

Why this answer

The 'diagnose log device show' output showing 'connected=no' indicates that the TCP connection between the FortiGate and FortiAnalyzer (typically on port 514 for syslog or port 514/3000 for FortiAnalyzer protocol) is not established. The most likely cause is a network issue preventing the FortiGate from reaching the FortiAnalyzer, as the connection status is directly tied to Layer 3 reachability and TCP handshake completion.

Exam trap

The trap here is that candidates often confuse 'connected=no' with log delivery failures caused by high log rates or buffer issues, but the connection status is a Layer 4 TCP state indicator, not a measure of log throughput or storage capacity.

How to eliminate wrong answers

Option A is wrong because a high log rate would cause logs to be dropped or buffered locally, but the connection status ('connected=no') would still show as 'connected=yes' if the TCP session to FortiAnalyzer is up; log dropping does not affect the device connectivity state. Option B is wrong because a full log buffer would cause log loss or overwriting, but the 'connected=no' status indicates the FortiGate has not established a TCP connection to the FortiAnalyzer, which is independent of buffer utilization. Option D is wrong because an expired FortiAnalyzer license would still allow log reception and the TCP connection to remain established; the FortiAnalyzer would simply stop processing or storing logs, but the FortiGate would still show 'connected=yes'.

Practice this question →

3

Multi-Selectmedium

A FortiGate is experiencing high latency on traffic passing through it. The administrator suspects that asymmetric routing is occurring. Which TWO symptoms are indicative of asymmetric routing?

Select 2 answers

A.The routing table shows multiple equal-cost paths to the same destination.

B.Traffic from the same source IP arrives on different interfaces for different sessions.

C.Traffic matching a policy is logged as allowed but the application does not work.

D.CPU usage is consistently above 90% during peak hours.

E.The firewall logs show TCP SYN packets but no corresponding SYN-ACK packets for the same session.

AnswersB, E

This indicates that the return traffic may be arriving on a different interface than expected.

Why this answer

Asymmetric routing occurs when traffic from the same source IP takes different paths through the network, causing packets to arrive on different FortiGate interfaces for different sessions. This breaks stateful inspection because the firewall expects all packets of a session to traverse the same interface; when they don't, it can lead to session timeouts or dropped packets, manifesting as high latency.

Exam trap

The trap here is that candidates often confuse asymmetric routing with general routing issues like ECMP (option A) or performance problems (option D), but the exam specifically tests the stateful firewall behavior where traffic arriving on different interfaces for the same session is the definitive symptom.

Practice this question →

4

MCQhard

A FortiGate in an HA cluster shows the message 'split-brain detected' in the event log. The administrator checks the HA status and sees both units are in 'standalone' mode. What is the MOST likely cause of this split-brain scenario?

A.The heartbeat interface is down on both units, causing them to assume they are the primary

B.The HA priority is set to the same value on both units

C.The HA mode is set to 'active-active' instead of 'active-passive'

D.The HA cluster is using a unicast heartbeat and the configuration is incorrect

AnswerA

When heartbeat communication is lost, both units may assume primary role, leading to split-brain.

Why this answer

When the heartbeat interface fails on both units, each FortiGate loses communication with its peer and assumes it is the sole surviving unit. This causes both to transition to 'standalone' mode and operate independently, which is the classic split-brain scenario. The event log message 'split-brain detected' confirms that the cluster has lost heartbeat connectivity, leading to each unit believing it must take over as primary.

Exam trap

The trap here is that candidates often assume split-brain is caused by configuration mismatches (like priority or mode), but the core issue is always a loss of heartbeat communication between the cluster members, leading both to operate independently in standalone mode.

How to eliminate wrong answers

Option B is wrong because identical HA priority values do not cause a split-brain; they simply affect the election process, and FortiGate HA can handle tie-breaking via other criteria like serial number. Option C is wrong because active-active mode is a valid HA configuration and does not inherently cause a split-brain; split-brain is a connectivity issue, not a mode selection issue. Option D is wrong because an incorrect unicast heartbeat configuration could prevent cluster formation, but it would not cause both units to enter 'standalone' mode simultaneously; typically one would fail to join the cluster, not both becoming standalone.

Practice this question →

5

Multi-Selecteasy

A FortiGate is experiencing high CPU usage due to a large number of sessions. Which TWO actions can the admin take to mitigate the issue? (Choose two.)

Select 2 answers

A.Set a shorter session TTL for idle sessions to free up resources

B.Increase the session table size

C.Upgrade the firmware to the latest version

D.Implement session rate limiting using 'config system session-ttl'

E.Disable all security profiles

AnswersA, D

Shorter TTL removes idle sessions quicker, reducing table size and CPU overhead.

Why this answer

Setting a shorter session TTL for idle sessions (Option A) reduces the time inactive sessions remain in the session table, freeing up memory and CPU resources used for session maintenance. This directly addresses high CPU caused by a large number of sessions by accelerating the cleanup of stale entries.

Exam trap

The trap here is that candidates may confuse session table size (a capacity metric) with session management efficiency, or assume that disabling security profiles is a valid troubleshooting step when it is actually a last-resort workaround that compromises security.

Practice this question →

6

MCQhard

An administrator is troubleshooting an SD-WAN scenario where traffic from a branch office to a critical SaaS application is experiencing high latency. The SD-WAN rule uses the best quality SLA strategy. The administrator runs 'diagnose sys sdwan neighbor' and sees that both WAN links have SLA compliance above 90%. However, traffic still uses the slower link. The administrator then runs 'diagnose sys sdwan health-check list' and notices that the health-check server IP is different from the SaaS application's server IP. What is the MOST likely reason the traffic is not using the best-performing link?

A.The health-check server's IP does not match the application's destination IP, so SLA measurements are not representative

B.The SD-WAN rule is configured with 'set load-balance-mode' instead of 'best-quality'

C.The health-check server is not reachable from the faster link

D.The SD-WAN rule has a manual routing override configured

AnswerA

SLA probes measure performance to the configured server, which may not correlate with actual performance to a different destination. The administrator should configure a health-check server that represents the real application traffic.

Why this answer

The SD-WAN rule uses the best quality SLA strategy, which selects the link with the best SLA metrics (latency, jitter, packet loss) for the traffic. However, if the health-check server IP does not match the SaaS application's destination IP, the SLA measurements are not representative of the actual path to the application. The SD-WAN device measures performance to the health-check server, not the application server, so the link that appears best for the health-check may be worse for the actual application traffic, causing the slower link to be selected.

Exam trap

The trap here is that candidates assume high SLA compliance on both links means the best link will always be selected, but they overlook that the health-check target must match the application destination for SLA measurements to be relevant.

How to eliminate wrong answers

Option B is wrong because the question states the SD-WAN rule uses the best quality SLA strategy, so 'set load-balance-mode' is not configured; if it were, traffic would be distributed based on load balancing, not SLA quality. Option C is wrong because if the health-check server were not reachable from the faster link, the SLA would show non-compliance for that link, but the output shows both links have SLA compliance above 90%. Option D is wrong because a manual routing override would bypass SD-WAN policy entirely, but the administrator is observing SD-WAN behavior (traffic using a slower link despite SLA compliance), and the diagnostic commands confirm SD-WAN is active.

Practice this question →

7

MCQhard

An administrator is testing failover in an HA cluster. They unplug the primary FortiGate's port1 (the heartbeat interface) but the secondary does not take over. The heartbeat is configured on port1. What is the MOST likely cause?

A.The primary unit still has a heartbeat path through other interfaces

B.The HA uptime is less than the failover hold time

C.The secondary unit's priority is higher than the primary's

D.The secondary unit has a faulty power supply

AnswerA

If heartbeat is configured on multiple interfaces, the secondary may still receive heartbeat from the primary via another interface, preventing failover.

Why this answer

In a FortiGate HA cluster, the heartbeat interface is used to monitor the health of the primary unit. When the primary's port1 (heartbeat interface) is unplugged, the cluster can still maintain communication if the primary has an alternative heartbeat path through other interfaces (e.g., a dedicated HA management interface or a secondary heartbeat link). This prevents the secondary from detecting a complete failure, so it does not initiate a failover.

Exam trap

The trap here is that candidates often assume unplugging the heartbeat interface will always trigger a failover, but FortiGate HA can maintain heartbeat redundancy through other interfaces, so the secondary does not take over unless all heartbeat paths are lost.

How to eliminate wrong answers

Option B is wrong because the HA uptime and failover hold time affect the initial synchronization and failover delay, but they do not prevent failover when a heartbeat interface is physically disconnected. Option C is wrong because a higher priority on the secondary would make it the primary, but the question states the secondary does not take over, so priority is not the issue. Option D is wrong because a faulty power supply would cause the secondary to be completely offline or unable to respond, but the scenario describes the secondary as operational but not taking over, so power supply is not the cause.

Practice this question →

8

MCQeasy

A network administrator runs 'get system ha status' on a FortiGate HA cluster and sees that only one unit shows as primary. The secondary unit shows as 'standalone' with no HA peer detected. What is the MOST likely cause of this issue?

A.The cluster serial numbers do not match

B.The heartbeat interface is down or misconfigured

C.The HA group ID is different on each unit

D.The HA priority on the secondary unit is set to 0

AnswerB

If the heartbeat link fails, the secondary cannot communicate with the primary and will assume it is standalone, resulting in the observed status.

Why this answer

When a secondary unit shows as 'standalone' with no HA peer detected, it indicates that the heartbeat communication between the two FortiGate units has failed. The most common cause is that the heartbeat interface is down, misconfigured, or not physically connected, preventing the units from discovering each other as HA peers. Without a functioning heartbeat link, the secondary unit cannot join the cluster and remains in standalone mode.

Exam trap

The trap here is that candidates often confuse 'no HA peer detected' with configuration mismatches like serial numbers or group IDs, but those mismatches still allow peer detection and generate specific error messages, whereas a failed heartbeat link results in a complete lack of peer visibility.

How to eliminate wrong answers

Option A is wrong because mismatched serial numbers would cause the units to reject each other as valid HA members, but the secondary unit would still detect the peer and show an error or 'mismatch' status, not 'standalone'. Option C is wrong because a different HA group ID would prevent the units from forming a cluster, but the secondary unit would still see the peer and report a group ID mismatch, not a 'no HA peer detected' state. Option D is wrong because setting the HA priority to 0 on the secondary unit would not prevent it from detecting the primary; it would simply make the secondary unit ineligible to become primary, but it would still join the cluster and show as a secondary member.

Practice this question →

9

MCQmedium

A FortiGate admin runs 'diagnose debug application authd -1' but sees no output for LDAP authentication attempts. What is the MOST likely reason?

A.The LDAP server is unreachable

B.The FortiGate is in FIPS mode

C.The LDAP server timed out

D.Debug flow is not enabled

AnswerB

In FIPS mode, FortiGate disables many debug capabilities to maintain compliance, so authd debug output will not be displayed even if authentication attempts are occurring. This is the most likely reason.

Why this answer

The 'diagnose debug application authd -1' command enables verbose debug logging for the authentication daemon. However, on a FortiGate running in FIPS mode, many debug commands are restricted or produce no output to comply with security requirements. This is the most likely reason for observing no LDAP authentication debug output.

Other possible reasons include running the command after authentication attempts have completed, but FIPS mode is a definitive system-level constraint.

Exam trap

Candidates often assume that additional debug flow is needed when 'diagnose debug application authd' shows no output, but the real common reason is that the FortiGate is in FIPS mode, which restricts debug commands. Alternatively, if the debug command is run after the fact, no historical output is shown.

How to eliminate wrong answers

Option A is wrong because an unreachable LDAP server would still generate authd debug output (e.g., connection failure messages) if debug flow were enabled; the issue is that no output appears at all, not that authentication fails. Option B is wrong because FIPS mode affects cryptographic compliance, not the visibility of debug output; authd debug still works in FIPS mode. Option C is wrong because an LDAP server timeout would produce a timeout error in the authd debug log (e.g., 'LDAP server timeout'), but the problem states no output is seen, indicating the debug mechanism itself is not capturing the traffic.

Practice this question →

10

MCQmedium

An administrator configures BGP route advertisement but the routes are not being sent to the neighbor. The BGP session is established. What is the MOST likely cause?

A.The BGP administrative distance is set too high

B.The BGP neighbor has the wrong update-source interface

C.The route is filtered by a route-map

D.The 'network' statement is missing for the desired prefix

AnswerD

Without a network statement, FortiGate does not advertise the route even if it is in the routing table.

Why this answer

The BGP session is established, so Layer 3 connectivity and TCP port 179 are working. The most common reason for routes not being advertised to a neighbor is that the 'network' statement is missing for the desired prefix. In BGP, the 'network' command does not advertise the prefix unless it matches an exact route in the IP routing table; without it, BGP has no prefix to send, even if the session is up.

Exam trap

The trap here is that candidates often assume a BGP session being established guarantees route advertisement, but BGP requires explicit 'network' statements or redistribution to inject prefixes, and the session state only indicates TCP connectivity and BGP open message exchange.

How to eliminate wrong answers

Option A is wrong because BGP administrative distance (e.g., 20 for eBGP, 200 for iBGP) affects route preference in the routing table, not the advertisement of routes to a neighbor. Option B is wrong because the update-source interface only affects the source IP of BGP packets; if the session is already established, the update-source is correctly configured, so it cannot be the cause of missing route advertisements. Option C is wrong because while a route-map can filter routes, the question states the session is established and routes are not being sent; a missing 'network' statement is a more fundamental and likely cause than a route-map, which would require explicit configuration to block routes.

Practice this question →

11

MCQhard

An administrator is troubleshooting BGP and runs 'get router info bgp neighbors 10.0.0.1' and sees 'BGP state = Active'. The neighbor IP is reachable via ping. What is the most likely cause?

A.The BGP update-source interface is missing

B.The BGP network statement is missing

C.The BGP router-id is not configured

D.The BGP neighbor's remote-as is misconfigured

AnswerD

A mismatch in remote AS will cause the neighbor to reject the connection, leading to Active state.

Why this answer

The BGP state 'Active' indicates that the router is actively trying to establish a TCP connection to the neighbor but is failing. Since the neighbor IP is reachable via ping (Layer 3 connectivity is fine), the most likely cause is a misconfiguration of the remote-as on one side, causing a BGP OPEN message mismatch (the received AS number does not match the expected remote-as). This prevents the TCP session from completing the BGP peering process.

Exam trap

The trap here is that candidates often assume 'Active' means a Layer 3 connectivity issue (like a missing route or firewall block), but since ping succeeds, the problem is specifically a BGP parameter mismatch, most commonly the remote-as.

How to eliminate wrong answers

Option A is wrong because a missing update-source interface would typically cause the BGP session to remain in 'Idle' or 'Connect' state, not 'Active', and the neighbor IP is reachable via ping, indicating the source interface is not the primary issue. Option B is wrong because a missing network statement only affects route advertisement, not the BGP neighbor state; the session can still reach 'Established' without any network statements. Option C is wrong because a missing router-id would prevent the BGP process from starting, causing the session to stay in 'Idle' state, not 'Active'; FortiOS automatically assigns a router-id if not configured.

Practice this question →

12

MCQhard

A FortiGate is deployed as the edge firewall for a medium-sized enterprise. The network has three internal zones: Trust (10.10.0.0/16), DMZ (172.16.0.0/24), and Guest (192.168.0.0/24). The FortiGate has an IPSec VPN to a branch office (10.20.0.0/16). Users in the Trust zone report intermittent connectivity to a web server in the DMZ (172.16.0.10, TCP port 443). The FortiGate logs show occasional 'session denied' messages for traffic from Trust to DMZ with reason 'denied by forward policy check'. The security policy has an explicit allow rule for Trust to DMZ HTTPS. The administrator has verified routing is correct and there are no address overlaps. When the issue occurs, the administrator runs 'diag debug flow' and sees that the packet matches the correct policy but still gets denied. The debug output also shows 'forward policy check: denied'. What is the most likely cause and recommended action?

A.A traffic shaping policy or application control profile is blocking the traffic; review and adjust the traffic shaping policy or application control profile applied to the policy.

B.The route to the DMZ is intermittently flapping; add a static route with a higher distance.

C.The security profiles (AV, IPS) are blocking the traffic; temporarily disable all security profiles on the policy.

D.The session helper for HTTPS is interfering; disable the HTTPS session helper.

AnswerA

Forward policy check denials are caused by traffic shaping or application control.

Why this answer

The debug flow output shows the packet matches the correct security policy but is still denied by 'forward policy check'. This indicates that a secondary policy component, such as a traffic shaping policy or application control profile, is blocking the traffic. These features can override the security policy action if they are configured to deny or drop matching traffic, even when the security policy itself is set to allow.

Exam trap

The trap here is that candidates often assume a security policy 'allow' rule is sufficient, overlooking that FortiGate's forward policy check evaluates additional policy layers (like traffic shaping or application control) that can independently deny traffic even after a security policy match.

How to eliminate wrong answers

Option B is wrong because route flapping would cause 'no route to host' errors, not 'denied by forward policy check' in the debug flow; the administrator has already verified routing is correct. Option C is wrong because security profiles (AV, IPS) would show specific block messages in the logs (e.g., 'IPS: blocked') and the debug flow would indicate the profile action, not a generic 'forward policy check' denial. Option D is wrong because the HTTPS session helper is used for non-standard ports or explicit proxy scenarios and does not cause 'forward policy check' denials; disabling it would not resolve a policy-based block.

Practice this question →

13

MCQeasy

An administrator needs to monitor the FortiGate's CPU usage in real-time from the CLI. Which command should be used?

A.diagnose debug application httpsd

B.diagnose hardware sysinfo memory

C.get system performance status

D.diagnose sys top

AnswerD

This is the correct command for real-time CPU monitoring.

Why this answer

'diagnose sys top' is the FortiGate CLI command that provides a real-time, top-like display of CPU usage per process, including process IDs and CPU consumption percentages. This command is specifically designed for live performance monitoring and troubleshooting from the CLI, unlike static snapshots or debug outputs.

Exam trap

The trap here is that candidates often confuse 'get system performance status' (a static snapshot) with a real-time monitoring tool, or they mistakenly think debug commands like 'diagnose debug application' are used for performance metrics instead of debugging specific daemon logs.

How to eliminate wrong answers

Option A is wrong because 'diagnose debug application httpsd' enables debug logging for the HTTPS daemon, not CPU monitoring; it outputs verbose HTTP-related debug messages. Option B is wrong because 'diagnose hardware sysinfo memory' displays memory usage statistics (total, used, free), not CPU usage. Option C is wrong because 'get system performance status' shows a static summary of CPU, memory, and session utilization at the moment of execution, but it does not provide the real-time, continuously updating process-level view that 'diagnose sys top' offers.

Practice this question →

14

MCQmedium

A FortiGate administrator notices that traffic from a specific subnet is being dropped unexpectedly. The security policy allows the traffic, and there are no firewall policies blocking it. What is the most efficient first step to identify the cause of the drops?

A.Use the 'diag sniffer packet any "host 10.0.1.0/24" 4' command to capture packets and analyze where they are dropped.

B.Run 'diagnose debug flow' with the source IP and look for 'no matching policy' or 'dropped' messages.

C.Enable 'deny-log' on all policies and check logs for the subnet.

D.Enable global traffic logging and review logs after some traffic passes.

AnswerA

Packet sniffer with filter can capture the actual packets and show the drop reason in the output.

Why this answer

The 'diag sniffer packet any "host 10.0.1.0/24" 4' command captures packets at the kernel level before firewall processing, allowing you to see if traffic is reaching the FortiGate and where it is being dropped (e.g., due to reverse-path forwarding, session helper, or DoS policies). This is the most efficient first step because it provides immediate, low-level visibility into packet drops without requiring configuration changes or waiting for logs.

Exam trap

The trap here is that candidates often jump to 'diagnose debug flow' as the default troubleshooting tool, but it only works after a session is created, missing pre-session drops that the sniffer can immediately expose.

How to eliminate wrong answers

Option B is wrong because 'diagnose debug flow' is a session-level debug that requires traffic to first match a session; if traffic is dropped before session creation (e.g., by ASIC, DoS policy, or RPF check), the debug flow may show no output or misleading 'no matching policy' messages, wasting time. Option C is wrong because enabling 'deny-log' on all policies only logs drops caused by explicit firewall policies, but the question states no policies are blocking the traffic, so this would not capture the actual drop cause (e.g., session helper, DoS, or routing issues). Option D is wrong because enabling global traffic logging requires a configuration change and waiting for traffic to pass, which is inefficient; logs may also not show the specific drop reason (e.g., kernel-level drops are not always logged).

Practice this question →

15

MCQmedium

Two FortiGates in an HA cluster are experiencing a split-brain scenario where both units become primary. The administrator checks the HA configuration and sees that the heartbeat interfaces are configured correctly but the link status is 'down' on both units. What could cause this?

A.The heartbeat interface has been administratively disabled

B.The physical cable connecting the heartbeat interfaces is faulty

C.The HA group ID is different on each unit

D.The HA priority values are the same on both units

AnswerB

Correct. A faulty cable causes link down, leading to loss of heartbeat and split-brain.

Why this answer

A split-brain occurs when heartbeat communication is lost. If the heartbeat interfaces show link down, it indicates a physical or layer-1 issue, such as a faulty cable or switch port.

Practice this question →

16

MCQeasy

An administrator needs to verify if a FortiGate is receiving BGP routes from a peer. Which command should the admin run to see the BGP routing table?

A.get router info routing-table bgp

B.show ip bgp

C.diagnose ip router bgp table

D.get router info bgp table

AnswerD

This command shows the BGP routing table entries.

Why this answer

'get router info bgp table' is the exact FortiOS CLI command to display the BGP routing table, showing all BGP-learned routes and their attributes. This command is specific to FortiGate's proprietary CLI syntax, which differs from Cisco IOS or generic Linux networking commands. The administrator needs this output to verify received BGP prefixes from a peer.

Exam trap

The trap here is that candidates familiar with Cisco IOS might instinctively choose 'show ip bgp' (Option B) or misremember FortiGate syntax as similar to Cisco's 'show ip bgp table', but FortiGate uses a distinct CLI structure where 'get router info bgp table' is the correct command for viewing the BGP table.

How to eliminate wrong answers

Option A is wrong because 'get router info routing-table bgp' is not a valid FortiOS command; the correct syntax for viewing the routing table filtered by BGP is 'get router info routing-table bgp' on FortiGate, but this shows the actual routing table (RIB) entries, not the raw BGP table (Adj-RIB-In). Option B is wrong because 'show ip bgp' is a Cisco IOS command, not a FortiGate command; FortiGate uses 'get' instead of 'show' and has different syntax. Option C is wrong because 'diagnose ip router bgp table' is not a valid FortiOS command; the 'diagnose' commands are for debugging and do not include a 'table' subcommand for BGP.

Practice this question →

17

MCQeasy

An administrator needs to check the health of an SD-WAN link by viewing the last SLA probe results. Which command should be used?

A.diagnose sys sdwan sla-log

B.get system interface physical

C.diagnose debug application sdwan -1

D.diagnose sys virtual-wan-link health-check

AnswerD

This command shows the results of SD-WAN health checks including SLA status.

Why this answer

The command `diagnose sys virtual-wan-link health-check` displays the last SLA probe results for SD-WAN links, including metrics like latency, jitter, and packet loss. This command is specifically designed for FortiGate SD-WAN (formerly virtual-wan-link) to verify real-time health-check status, which is essential for troubleshooting link performance.

Exam trap

The trap here is that candidates confuse the SD-WAN SLA log command (`diagnose sys virtual-wan-link sla-log`) with the health-check command, or mistakenly think debug commands show historical results, when in fact only the health-check command provides the last probe results.

How to eliminate wrong answers

Option A is wrong because `diagnose sys sdwan sla-log` is not a valid FortiGate command; the correct command for viewing SLA logs is `diagnose sys virtual-wan-link sla-log`. Option B is wrong because `get system interface physical` shows physical interface status and statistics, not SD-WAN SLA probe results. Option C is wrong because `diagnose debug application sdwan -1` enables debug logging for the SD-WAN daemon, which is used for real-time troubleshooting but does not display historical SLA probe results.

Practice this question →

18

Multi-Selecthard

A FortiGate administrator is investigating a slow network performance issue. The administrator suspects that session table limits are being reached. Which TWO metrics should be monitored to confirm this? (Choose two.)

Select 2 answers

A.Interface bandwidth utilization

B.Session fail rate

C.Current session count

D.CPU usage

E.Memory usage

AnswersB, C

A high session fail rate may indicate that new session creation is being denied due to table limits.

Why this answer

The session fail rate (B) directly indicates when the FortiGate is unable to establish new sessions because the session table is full, which is a clear symptom of hitting session table limits. The current session count (C) shows how many sessions are active; when this approaches the maximum session limit (e.g., 2 million on a FortiGate-600E), it confirms the table is near capacity. Monitoring both metrics together provides definitive evidence of session table exhaustion.

Exam trap

The NSE7 exam often tests the misconception that high CPU or memory usage directly indicates session table limits, but the trap here is that session table exhaustion is specifically confirmed by session fail rate and current session count, not by general resource utilization metrics.

Practice this question →

19

Multi-Selectmedium

An administrator is troubleshooting an IPsec VPN tunnel that establishes phase 1 but fails to establish phase 2. The phase 2 configuration shows 'set proposal aes128-sha256' on both sides. Which TWO configuration items should the administrator verify?

Select 2 answers

A.PFS (Perfect Forward Secrecy) settings

B.The local authentication method (certificate vs pre-shared key)

C.The encryption algorithm for phase 2

D.The local and remote subnets defined in phase 2 (proxy IDs)

E.The pre-shared key

AnswersA, D

If one side has PFS enabled and the other does not, or they use different DH groups, phase 2 will fail.

Why this answer

PFS ensures that if one session key is compromised, previous and future session keys remain secure by using a Diffie-Hellman exchange in phase 2. If PFS is enabled on one side but not the other, or if the DH groups do not match, phase 2 will fail even when the encryption and authentication proposals are identical. Since the phase 2 proposal 'aes128-sha256' matches on both sides, the mismatch likely lies in PFS settings.

Exam trap

The trap here is that candidates assume matching encryption and authentication proposals guarantee phase 2 success, overlooking PFS and proxy ID mismatches which are frequently tested in NSE7 troubleshooting scenarios.

Practice this question →

20

MCQhard

In an HA cluster, after a failover, some established sessions are not being synchronized to the new primary unit. Which setting must be enabled to ensure session synchronization?

A.set override enable

B.set sync-sessions enable

C.set priority <value>

D.set session-pickup enable

AnswerD

This enables session synchronization in HA.

Why this answer

Session-pickup is the FortiGate HA feature that synchronizes the state of established sessions from the primary unit to the backup unit. When a failover occurs, the new primary unit can continue forwarding traffic for those sessions without interruption only if session-pickup is enabled. Without it, all existing sessions are dropped and must be re-established by the clients.

Exam trap

The trap here is that candidates confuse 'session-pickup' with general HA synchronization or misremember the exact CLI command, often selecting 'set sync-sessions enable' which sounds plausible but does not exist in FortiGate's configuration.

How to eliminate wrong answers

Option A is wrong because 'set override enable' controls which unit becomes primary after a failover based on priority, not session synchronization. Option B is wrong because 'set sync-sessions enable' is not a valid FortiGate HA command; the correct command for session synchronization is 'set session-pickup enable'. Option C is wrong because 'set priority <value>' sets the device priority for HA role election, not session state synchronization.

Practice this question →

21

Multi-Selecteasy

A FortiGate administrator wants to monitor performance thresholds to be alerted when the firewall is under heavy load. Which THREE metrics can be monitored using the built-in performance monitoring features (e.g., 'diagnose sys top' or SNMP)?

Select 3 answers

A.CPU utilization percentage

B.Interface speed

C.Number of concurrent sessions

D.Disk space utilization

E.Memory utilization percentage

AnswersA, C, E

CPU usage is a critical performance indicator.

Why this answer

The built-in 'diagnose sys top' command and SNMP monitoring both provide real-time CPU utilization percentage, which is a key metric for detecting heavy load on a FortiGate firewall. High CPU usage can indicate resource contention, impacting packet processing and overall performance.

Exam trap

The trap here is that candidates confuse static interface properties (like speed) with dynamic performance metrics, or mistakenly think disk space is relevant to firewall load, when in fact only CPU, memory, and session counts are directly monitored for performance thresholds.

Practice this question →

22

Multi-Selecthard

An administrator is troubleshooting an IPsec VPN Phase 2 negotiation failure. The debug shows 'no matching phase 2 proposal' from the remote peer. Which TWO of the following are likely causes? (Choose two.)

Select 2 answers

A.The local and remote proxy IDs (subnets) are not matching

B.The pre-shared key is incorrect

C.The firewall policy does not allow UDP port 500

D.The encryption algorithm (e.g., AES256 vs AES128) does not match between peers

E.The IKE version (IKEv1 vs IKEv2) is different

AnswersA, D

Phase 2 requires matching proxy IDs to establish SAs.

Why this answer

IPsec Phase 2 negotiation requires the proxy IDs (local and remote subnets) to match exactly between peers. The 'no matching phase 2 proposal' debug message indicates the remote peer received a proposal with a subnet or traffic selector that does not match its configured proxy ID. This is a common misconfiguration when defining which traffic should be encrypted over the VPN tunnel.

Exam trap

The trap here is that candidates often confuse Phase 1 and Phase 2 parameters, incorrectly attributing a Phase 2 'no matching proposal' error to authentication or IKE version mismatches, which actually cause Phase 1 failures.

Practice this question →

23

Multi-Selectmedium

A network administrator is troubleshooting a split-brain scenario in an HA cluster. Which TWO conditions can cause split-brain? (Choose two.)

Select 2 answers

A.Loss of heartbeat link between HA members

B.One unit has a higher priority

C.Firmware version mismatch

D.Mismatched HA configuration (e.g., different HA mode)

E.Session pickup is disabled

AnswersA, D

Without heartbeat, each unit assumes the other is down and becomes primary.

Why this answer

Options A and D are correct. Loss of HA heartbeat communication (A) causes both units to think they are primary. Mismatched HA configuration (D) can also cause split-brain.

Option B causes failover but not split-brain. Option C is irrelevant.

Practice this question →

24

Multi-Selectmedium

An admin is troubleshooting an IPsec VPN tunnel that is failing phase 2. The IKE debug shows 'no matching proposal'. Which TWO settings should the admin verify on both sides? (Choose two.)

Select 2 answers

A.Dead Peer Detection interval

B.Encryption algorithm (e.g., AES128, AES256)

C.Diffie-Hellman group for PFS

D.Pre-shared key

E.Local and remote gateway IP addresses

AnswersB, C

Part of phase 2 proposal.

Why this answer

In IPsec phase 2, the IKE debug message 'no matching proposal' indicates a mismatch in the security association (SA) parameters used to establish the IPsec SA. The encryption algorithm (option B) is a core component of the IPsec proposal that must match exactly on both peers. Perfect Forward Secrecy (PFS) using a Diffie-Hellman group (option C) is also negotiated during phase 2; if one side requires PFS and the other does not, or if the DH groups differ, phase 2 will fail with this error.

Exam trap

The trap here is that candidates often confuse phase 1 and phase 2 parameters, incorrectly selecting pre-shared key (option D) or gateway IPs (option E) as causes for a phase 2 proposal mismatch, when in fact only the IPsec SA parameters (encryption, authentication, PFS) are negotiated in phase 2.

Practice this question →

25

MCQmedium

A FortiGate administrator is troubleshooting a VPN tunnel that connects to a remote site. The tunnel is up, but traffic is not passing. The administrator checks the Phase 2 settings and sees that the local and remote subnets are correctly defined. What is the next step to diagnose the issue?

A.Check the firewall policies that reference the VPN interface

B.Check the routing table for the remote subnet

C.Run 'diagnose vpn ike log' to check for Phase 1 errors

D.Restart the VPN tunnel

AnswerA

Even if the tunnel is up, traffic must be allowed by a firewall policy from the VPN interface to the destination zone.

Why this answer

When the VPN tunnel is up (Phase 1 and Phase 2 are established) but traffic is not passing, the most common cause is that a firewall policy referencing the VPN interface is either missing or misconfigured. Even with correct Phase 2 selectors and routing, the FortiGate will drop traffic if no policy explicitly permits it from the source to the destination over the VPN interface. Therefore, checking the firewall policies is the logical next step.

Exam trap

The trap here is that candidates assume a working Phase 2 (tunnel up) guarantees traffic flow, but FortiGate requires an explicit firewall policy to permit traffic through the VPN interface, unlike some other vendors where a route alone is sufficient.

How to eliminate wrong answers

Option B is wrong because if the tunnel is up and Phase 2 subnets are correctly defined, the routing table for the remote subnet is typically already present (either statically or via dynamic routing); a missing route would prevent the tunnel from coming up or cause Phase 2 to fail, not just block traffic. Option C is wrong because 'diagnose vpn ike log' is used to debug Phase 1 (IKE) issues, but the tunnel is already up, indicating Phase 1 completed successfully; this command would not reveal why traffic is not passing through an established tunnel. Option D is wrong because restarting the VPN tunnel is a brute-force approach that does not diagnose the root cause; if the tunnel is up and the configuration is correct, restarting it will not resolve a missing or misconfigured firewall policy.

Practice this question →

26

MCQmedium

A network administrator is troubleshooting an IPsec VPN tunnel that fails to establish. The remote gateway logs show a proposal mismatch. On FortiGate, the administrator runs 'diagnose vpn ike config' and sees 'proposal: aes128-sha1, aes256-sha256'. The remote side expects 'aes256-sha1'. What is the most likely cause?

A.The Phase 1 proposal list does not include the algorithm combination the remote gateway requires

B.The pre-shared key is incorrect

C.The Phase 2 selectors are misconfigured

D.The IKE version is set to 1 but remote uses 2

AnswerA

Correct. The local proposal list must contain at least one matching algorithm set that the remote gateway supports.

Why this answer

The 'diagnose vpn ike config' output shows the FortiGate's Phase 1 proposal list includes 'aes128-sha1' and 'aes256-sha256', but the remote gateway expects 'aes256-sha1'. Since neither of the local proposals matches the remote's required combination, the IKE negotiation fails with a 'proposal mismatch' error. The administrator must add 'aes256-sha1' to the Phase 1 proposal list on the FortiGate to align with the remote gateway's expectation.

Exam trap

The trap here is that candidates often confuse a proposal mismatch with a pre-shared key or IKE version issue, but the specific error message and the 'diagnose vpn ike config' output directly point to an algorithm mismatch in Phase 1, not authentication or version negotiation.

How to eliminate wrong answers

Option B is wrong because a pre-shared key mismatch typically results in an authentication failure, not a proposal mismatch; the logs would show 'authentication failed' or 'invalid cookie' rather than a proposal error. Option C is wrong because Phase 2 selectors (traffic selectors) are negotiated after Phase 1 is established, so a Phase 2 misconfiguration would cause the tunnel to fail later, not prevent Phase 1 from completing. Option D is wrong because an IKE version mismatch (v1 vs v2) would produce a different error, such as 'no acceptable proposal' or 'unsupported IKE version', not a proposal mismatch on algorithms; the proposal mismatch specifically refers to encryption/hash algorithms, not the IKE version.

Practice this question →

27

MCQeasy

An administrator wants to monitor the session count on a FortiGate in real time. Which CLI command provides this information?

A.diagnose sys top

B.get system performance status

C.diagnose sys session stat

D.diagnose debug enable

AnswerC

This command displays current session statistics including total session count.

Why this answer

'diagnose sys session stat' is the specific FortiGate CLI command that displays real-time session statistics, including the total number of sessions currently tracked by the firewall. This command provides a live count of active sessions, which is exactly what the administrator needs for real-time monitoring.

Exam trap

The trap here is confusing general performance monitoring commands (like 'get system performance status') with session-specific diagnostics, leading candidates to select options that show system health but not the exact session count required.

How to eliminate wrong answers

Option A is wrong because 'diagnose sys top' shows real-time CPU and memory usage per process, not session counts. Option B is wrong because 'get system performance status' displays overall system performance metrics like CPU load and memory usage, but does not include session count details. Option D is wrong because 'diagnose debug enable' is used to enable debug output for troubleshooting, not to display session statistics.

Practice this question →

28

MCQeasy

An administrator applies the above policy but users from 10.0.1.0/24 cannot access web servers at 10.0.2.0/24. However, they can ping the servers. What is the most likely cause?

A.The service 'HTTP' does not include port 443 or the web application is using HTTPS.

B.The destination address is incorrect.

C.The schedule 'always' is not correctly configured.

D.The source interface is incorrect.

AnswerA

The service 'HTTP' only covers port 80; if the web server uses HTTPS (port 443), the policy won't match.

Why this answer

The policy allows HTTP traffic (port 80), but the web servers are likely using HTTPS (port 443). Since the service object 'HTTP' in FortiGate typically only includes TCP/80, HTTPS traffic is denied by default. The administrator can ping the servers because ICMP is permitted by an implicit or explicit policy, confirming that routing and connectivity are functional.

Exam trap

The trap here is that candidates assume 'HTTP' covers all web traffic, but FortiGate strictly matches the defined ports in the service object, so HTTPS (port 443) is blocked unless explicitly permitted.

How to eliminate wrong answers

Option B is wrong because the destination address 10.0.2.0/24 is correct for the web servers, and ping success confirms reachability. Option C is wrong because the schedule 'always' is a default, always-active schedule that cannot be misconfigured; if it were invalid, no traffic would pass. Option D is wrong because the source interface is correctly set to the interface connected to 10.0.1.0/24, as evidenced by successful ping traffic from that subnet.

Practice this question →

29

MCQhard

An administrator is investigating a security incident and needs to view raw logs from a FortiAnalyzer for a specific time range. The administrator wants to ensure the logs are not aggregated or summarized. Which type of log view should be used?

A.Event Management

B.FortiView

C.Reports

D.Log View

AnswerD

Log View displays raw, unaggregated logs from the FortiAnalyzer, ideal for detailed incident investigation.

Why this answer

The Log View in FortiAnalyzer displays raw, unaggregated logs exactly as received from FortiGate devices, making it the correct choice for viewing logs without summarization. Unlike other views that pre-process or summarize data, Log View provides direct access to the original log entries for a specified time range, which is essential for detailed incident investigation.

Exam trap

The trap here is that candidates confuse FortiView's real-time graphical summaries with raw log access, assuming 'Log View' is just another dashboard, when in fact FortiView aggregates data and Log View shows the original unmodified logs.

How to eliminate wrong answers

Option A is wrong because Event Management aggregates and correlates logs into events, summarizing multiple log entries into a single event record, which does not show raw logs. Option B is wrong because FortiView provides pre-processed, summarized graphical views and dashboards that aggregate data for quick analysis, not raw logs. Option C is wrong because Reports generate summarized, formatted output based on templates and scheduled aggregation, not the original unaggregated log entries.

Practice this question →

30

MCQhard

An administrator is troubleshooting an HA cluster (active-passive) where both units show 'primary' in 'get system ha status'. The cluster is not synchronizing configurations. What is the MOST likely cause?

A.The HA password is incorrect

B.The HA heartbeat interface is disconnected or misconfigured

C.The HA group ID is mismatched

D.The HA priority values are equal for both units

AnswerB

If heartbeat communication fails, each unit assumes the other is down and transitions to primary, causing a split-brain.

Why this answer

In an active-passive HA cluster, both units showing 'primary' indicates a failure in heartbeat communication. The HA heartbeat interface is used to exchange cluster state and session information; if it is disconnected or misconfigured, each unit assumes the other is down and transitions to primary, leading to a split-brain scenario. This prevents configuration synchronization because the units cannot agree on a primary-secondary role.

Exam trap

The trap here is that candidates often assume an HA password mismatch or group ID mismatch causes role conflicts, but in reality, a heartbeat failure is the only scenario that makes both units independently declare themselves primary.

How to eliminate wrong answers

Option A is wrong because an incorrect HA password would cause authentication failures during heartbeat exchanges, but both units would still show their correct roles (primary/secondary) based on priority; they would not both become primary. Option C is wrong because a mismatched HA group ID would prevent the cluster from forming entirely, resulting in both units showing as standalone or 'standalone', not both as 'primary'. Option D is wrong because equal HA priority values do not cause both units to become primary; in an active-passive cluster, if priorities are equal, the unit with the higher serial number becomes primary, and the other becomes secondary, so both would not show 'primary'.

Practice this question →

31

Multi-Selectmedium

A FortiGate administrator is troubleshooting a BGP session that fails to establish with a neighbor at 10.0.1.1. Running 'diagnose ip router bgp all' shows the neighbor state as 'Idle'. Which TWO commands should the administrator run NEXT to diagnose the issue?

Select 2 answers

A.show full-configuration router bgp

B.execute ping 10.0.1.1

C.diagnose ip router bgp all

D.diagnose sys session filter dport 179

E.get router info bgp summary

AnswersA, B

This displays the complete BGP configuration, including neighbor IP, remote AS, and update-source, helping identify misconfiguration.

Why this answer

'show full-configuration router bgp' displays the complete BGP configuration, including all neighbor settings, network statements, and route-maps. This allows the administrator to verify that the neighbor at 10.0.1.1 is correctly configured with the proper remote-as, update-source, and any optional parameters that might prevent the session from leaving the Idle state. Option B is correct because a BGP session stuck in Idle often indicates a Layer 3 connectivity issue; pinging the neighbor confirms whether the destination is reachable, which is a fundamental prerequisite for TCP port 179 to establish.

Exam trap

The trap here is that candidates assume 'diagnose ip router bgp all' or 'get router info bgp summary' will provide the root cause, but these commands only confirm the Idle state without revealing whether the issue is configuration or connectivity, leading them to skip the fundamental Layer 3 check and the full configuration review.

Practice this question →

32

MCQmedium

A FortiGate VPN tunnel shows 'phase1 negotiation failed' in the logs. The remote gateway is a third-party device. The debug command 'diagnose vpn ike config' shows mismatched proposals. Which setting is MOST likely incorrect on the FortiGate?

A.The pre-shared key

B.The local ID type

C.The encryption algorithm (e.g., AES256 vs 3DES)

D.The DPD configuration

AnswerC

Mismatched encryption algorithms cause phase1 failure.

Why this answer

The 'diagnose vpn ike config' command displays the IKE proposal parameters (encryption, authentication, DH group) that the FortiGate is configured to offer. When the log shows 'phase1 negotiation failed' and the debug output indicates 'mismatched proposals', it means the FortiGate's configured encryption algorithm (e.g., AES256) does not match any algorithm supported by the remote third-party device (e.g., 3DES). This is the most direct cause of proposal mismatch, as IKE phase 1 requires both sides to agree on a common transform set.

Exam trap

The trap here is that candidates often confuse 'mismatched proposals' with authentication failures (pre-shared key) or identification issues (local ID), but the debug command specifically shows the proposal attributes, making encryption algorithm the most likely culprit.

How to eliminate wrong answers

Option A is wrong because a pre-shared key mismatch would cause an authentication failure after the proposal is accepted, not a 'mismatched proposals' error in the IKE config debug. Option B is wrong because the local ID type is used for identification and policy matching after phase 1 is established; it does not affect the initial proposal exchange. Option D is wrong because DPD (Dead Peer Detection) is a keepalive mechanism configured after phase 1 is complete; a DPD mismatch would not cause a phase 1 negotiation failure.

Practice this question →

33

MCQeasy

Which FortiGate command is used to view the current CPU usage of individual processes in real time?

A.diagnose sys session stat

B.get system performance status

C.diagnose sys top

D.diagnose hardware sysinfo memory

AnswerC

This shows real-time per-process CPU and memory usage.

Why this answer

The 'diagnose sys top' command on FortiGate provides a real-time, top-like display of CPU and memory usage for individual processes, allowing administrators to identify which specific daemons or tasks are consuming resources. This command is essential for troubleshooting performance issues at the process level, unlike other commands that show aggregate or different diagnostic data.

Exam trap

The trap here is that candidates often confuse 'get system performance status' (which shows overall CPU usage) with the per-process view needed for granular troubleshooting, leading them to select option B instead of the correct 'diagnose sys top'.

How to eliminate wrong answers

Option A is wrong because 'diagnose sys session stat' displays session statistics (total sessions, active sessions, etc.) and does not show CPU usage per process. Option B is wrong because 'get system performance status' shows overall system performance metrics (CPU, memory, disk) but not per-process CPU usage in real time. Option D is wrong because 'diagnose hardware sysinfo memory' reports memory hardware information and usage statistics, not CPU usage per process.

Practice this question →

34

MCQeasy

A FortiGate administrator needs to identify which process is consuming the most memory. Which command should be used?

A.diagnose sys top

B.show system resource usage

C.diagnose hardware sysinfo memory

D.get system performance status

AnswerA

This command displays processes and memory usage; pressing 'm' sorts by memory.

Why this answer

The 'diagnose sys top' command displays a real-time list of running processes sorted by CPU and memory usage, allowing the administrator to identify which process is consuming the most memory. This is the standard FortiGate CLI command for process-level resource monitoring, similar to 'top' on Linux systems.

Exam trap

The trap here is that candidates may confuse system-level memory commands (like 'diagnose hardware sysinfo memory' or 'show system resource usage') with process-level memory diagnostics, assuming any 'memory' or 'resource' command will show per-process details.

How to eliminate wrong answers

Option B is wrong because 'show system resource usage' displays overall system resource statistics (CPU, memory, disk) but does not break down memory usage by individual process. Option C is wrong because 'diagnose hardware sysinfo memory' shows hardware-level memory information (total, used, free) and memory module details, not per-process memory consumption. Option D is wrong because 'get system performance status' provides a summary of system performance metrics (CPU, memory, sessions) but lacks process-level granularity.

Practice this question →

35

Multi-Selectmedium

An administrator is troubleshooting a BGP session that is not establishing between two FortiGates. The administrator has verified that the neighbor IP is reachable. Which TWO commands should be used to further diagnose the issue? (Choose two.)

Select 2 answers

A.get router info bgp neighbor <IP>

B.diagnose debug flow filter daddr <IP>

C.get router info routing-table bgp

D.diagnose sys session filter dport 179

E.diagnose ip router bgp all enable

AnswersA, E

This command shows BGP session state and counters, useful for troubleshooting.

Why this answer

'get router info bgp neighbor <IP>' displays detailed BGP session state information, including the current state (e.g., Idle, Connect, Active, OpenSent, OpenConfirm, Established), hold timer, keepalive interval, and any error codes or notifications. This command directly reveals why the session is not establishing, such as a mismatch in BGP capabilities, AS numbers, or authentication.

Exam trap

The trap here is that candidates often confuse general network troubleshooting commands (like session filtering or flow debugging) with BGP-specific diagnostic commands, failing to recognize that BGP session establishment requires examining the BGP state machine and debug logs, not just TCP connectivity or routing table contents.

Practice this question →

36

MCQmedium

An administrator is configuring SD-WAN with multiple members. When a rule matches, traffic is not being load-balanced as expected. Which command should the admin use to verify the SD-WAN rule selection for a specific flow?

A.diagnose sys session list

B.get system sdwan status

C.diagnose netlink interface list

D.diagnose sys sdwan info

AnswerD

This command displays SD-WAN rules, members, and their status, aiding in rule selection verification.

Why this answer

'diagnose sys sdwan info' is the FortiOS command that displays detailed SD-WAN rule selection information, including which rule matched for a specific flow and how traffic is being load-balanced across members. This command provides real-time diagnostics on SD-WAN path selection, rule IDs, and member usage, which directly addresses the administrator's need to verify rule matching and load-balancing behavior.

Exam trap

The trap here is that candidates often confuse 'diagnose sys session list' (which shows session details but not SD-WAN rule selection) with the correct diagnostic command, leading them to pick Option A because they assume session information includes SD-WAN rule matching.

How to eliminate wrong answers

Option A is wrong because 'diagnose sys session list' shows session table entries but does not reveal which SD-WAN rule was matched or how load-balancing was applied; it only shows the resulting egress interface and session details. Option B is wrong because 'get system sdwan status' provides a high-level overview of SD-WAN configuration and member status, but it does not show per-flow rule selection or load-balancing decisions. Option C is wrong because 'diagnose netlink interface list' displays kernel-level interface information and link status, which is unrelated to SD-WAN rule matching or load-balancing logic.

Practice this question →

37

MCQhard

You are troubleshooting a BGP session between FortiGate and an ISP router. The FortiGate shows BGP state 'Active' and the debug output shows 'No route to peer'. The ISP router's loopback IP is 203.0.113.1, and the next-hop interface is port1 (10.0.0.1/30). The FortiGate has a static route to 203.0.113.1 via port1. What is the MOST likely cause?

A.The BGP neighbor IP is not reachable due to an ACL on the ISP router

B.The BGP update-source is set to a different interface

C.The static route's outgoing interface (port1) is administratively down

D.The BGP configuration has 'next-hop-self' disabled

AnswerC

If port1 is down, the static route is removed from the routing table, causing 'No route to peer'.

Why this answer

The 'Active' BGP state combined with 'No route to peer' indicates that the FortiGate cannot reach the BGP neighbor IP (203.0.113.1) via the routing table. Even though a static route exists, if the outgoing interface (port1) is administratively down, the route is not installed in the FIB, making the peer unreachable. This directly matches option C.

Exam trap

The trap here is that candidates assume a configured static route guarantees reachability, but FortiGate (and most routers) require the outgoing interface to be up for the route to be active in the routing table.

How to eliminate wrong answers

Option A is wrong because an ACL on the ISP router would block BGP packets (TCP port 179) but would not cause a 'No route to peer' debug message, which is a local routing issue. Option B is wrong because if the update-source were set to a different interface, the FortiGate would still have a route to the peer (assuming the static route is valid), and the BGP state would typically show 'Idle' or 'Connect', not 'Active' with a routing error. Option D is wrong because 'next-hop-self' affects how the next-hop attribute is advertised to iBGP peers, not the reachability of the BGP neighbor itself.

Practice this question →

38

Multi-Selecthard

An administrator notices that after upgrading FortiOS, some traffic that was previously inspected by the antivirus profile is now bypassing scanning. The administrator suspects the session helper configuration may be interfering. Which TWO session helper protocols are known to potentially affect traffic inspection if improperly configured?

Select 2 answers

C.PPTP

E.SIP

AnswersB, E

FTP helper manages data channels; improper configuration can lead to inspection gaps.

Why this answer

FTP (File Transfer Protocol) uses separate control and data channels, and FortiGate's session helper dynamically opens pinholes for the data channel. If the FTP session helper is improperly configured or disabled, the antivirus scanner may not inspect the data channel traffic, allowing it to bypass scanning. This is a known issue when upgrading FortiOS if the session helper configuration is not migrated correctly.

Exam trap

The trap here is that candidates often assume HTTP or TFTP are the culprits because they are common protocols, but the question specifically targets session helpers that manage dynamic port negotiation, which only FTP and SIP require among the options.

Practice this question →

39

MCQmedium

A BGP route from an ISP is not appearing in the FortiGate's routing table. The BGP session is established and 'show ip bgp' shows the route as valid but not best. Which command should the admin use to investigate why the route is not selected as best?

A.execute router bgp show

B.diagnose ip router bgp routes

C.get router info bgp summary

D.diagnose ip router bgp network

AnswerB

This command shows BGP route details and best path selection reasons.

Why this answer

'diagnose ip router bgp routes' is the FortiGate command that displays detailed BGP route information, including the reason a route is not selected as best (e.g., higher local preference, longer AS path, or lower MED). Since the BGP session is up and the route is valid but not best, this command reveals the tie-breaking criteria that caused the route to lose the best-path selection process.

Exam trap

The trap here is that candidates confuse 'diagnose ip router bgp routes' with 'get router info bgp summary', assuming the summary command provides route details, when in fact it only shows neighbor state and not the BGP table's best-path selection reasons.

How to eliminate wrong answers

Option A is wrong because 'execute router bgp show' is not a valid FortiGate command; the correct syntax for displaying BGP table summary is 'get router info bgp summary' or 'diagnose ip router bgp all'. Option C is wrong because 'get router info bgp summary' only shows BGP session status and neighbor statistics, not the detailed path attributes or best-path selection reasons for individual routes. Option D is wrong because 'diagnose ip router bgp network' is not a valid FortiGate command; the correct command for viewing BGP networks is 'show ip bgp network' on Cisco devices, not FortiGate.

Practice this question →

40

MCQhard

An administrator configures an ALG for SIP traffic but notices that some SIP calls are failing. The admin suspects the ALG is modifying SIP headers incorrectly. Which debug command can help verify the ALG's actions on SIP packets?

A.diagnose debug application sip -1

B.diagnose debug application alg -1

C.get system performance status

D.diagnose sys session filter proto 17

AnswerA

This enables detailed SIP ALG debug output.

Why this answer

The command 'diagnose debug application sip -1' enables detailed debugging of the SIP ALG process on FortiGate, showing how the ALG inspects and modifies SIP headers (e.g., Via, Contact, SDP). This allows the admin to verify if the ALG is incorrectly rewriting IP addresses or ports, which is a common cause of call failures. The '-1' flag sets the debug level to maximum verbosity, capturing all ALG-related SIP transactions.

Exam trap

The trap here is that candidates confuse the generic 'debug application alg' command with the protocol-specific debug commands, or they assume 'get system performance status' can diagnose ALG issues, when in fact only the protocol-specific debug (e.g., 'debug application sip') reveals header-level modifications.

How to eliminate wrong answers

Option B is wrong because 'diagnose debug application alg -1' is not a valid command; the correct syntax for debugging an ALG requires specifying the application protocol (e.g., 'sip', 'h323') after 'application', not 'alg' itself. Option C is wrong because 'get system performance status' shows system resource usage (CPU, memory) and does not provide packet-level or ALG-specific header modification details. Option D is wrong because 'diagnose sys session filter proto 17' filters sessions by protocol number 17 (UDP), which is useful for narrowing session dumps but does not debug ALG actions or show SIP header modifications.

Practice this question →

41

Multi-Selectmedium

An administrator is troubleshooting a scenario where VoIP traffic is not being properly handled by the FortiGate. The SIP ALG is enabled. Which THREE commands should the administrator run to diagnose the SIP traffic flow?

Select 3 answers

A.get router info routing-table all

B.diagnose sys session filter dport 5060

C.diagnose debug application sip -1

D.diagnose debug application sip -1

AnswersA, B, C

Correct. This command shows the routing table, which is essential to verify that the FortiGate has a valid route for SIP traffic to reach its destination. Without proper routing, SIP packets may be dropped or misrouted.

Why this answer

To diagnose SIP traffic flow with SIP ALG enabled on FortiGate, the administrator should use three key commands. Option A: `get router info routing-table all` checks the routing table to ensure that SIP packets have a valid path to their destination. Option B: `diagnose sys session filter dport 5060` filters the session table to display only sessions using destination port 5060 (default SIP signaling port), allowing verification that SIP sessions are being tracked.

Option C: `diagnose debug application sip -1` enables verbose debug logging for the SIP application, providing detailed information about how the SIP ALG processes each SIP packet, including parsing, rewriting, and errors. Together, these commands help identify routing issues, session tracking, and SIP ALG processing problems.

Exam trap

Candidates often focus only on session and debug commands, overlooking the importance of verifying the routing table to ensure SIP packets can reach their destination. The correct set includes all three: routing check, session filter, and debug.

Practice this question →

42

MCQeasy

Which of the following is a valid command to check the status of all BGP neighbors on a FortiGate?

A.diagnose router bgp summary

B.get router info bgp summary

C.show bgp neighbors

D.diagnose ip router bgp all

AnswerB

This is the correct command to display BGP neighbor status.

Why this answer

'get router info bgp summary' is the standard FortiGate CLI command to display the status of all BGP neighbors, including their state, uptime, and prefixes received. This command retrieves the BGP routing table summary from the FortiGate's routing daemon, which is essential for verifying neighbor relationships and troubleshooting BGP peering issues.

Exam trap

The trap here is that candidates familiar with Cisco IOS often default to 'show bgp neighbors' (Option C), but FortiGate uses a different CLI syntax with 'get router info' for operational state queries, and 'diagnose' commands are reserved for low-level debugging, not standard status checks.

How to eliminate wrong answers

Option A is wrong because 'diagnose router bgp summary' is not a valid FortiGate command; the 'diagnose' prefix is used for advanced debugging, but the correct syntax for BGP summary is under 'get router info bgp summary'. Option C is wrong because 'show bgp neighbors' is a Cisco IOS command, not a FortiGate CLI command; FortiGate uses 'get router info bgp neighbors' for detailed neighbor information, but the question specifically asks for a summary of all neighbors. Option D is wrong because 'diagnose ip router bgp all' is not a valid FortiGate command; the correct diagnostic command for BGP is 'diagnose router bgp all' (without 'ip'), but even that does not provide a summary of neighbor status.

Practice this question →

43

MCQhard

An administrator configures a session helper for FTP but notices that active FTP data connections are not being allowed through the firewall. The FTP control session establishes fine. What is the MOST likely cause?

A.The FTP server is using passive mode

B.The FTP session helper is not enabled on the firewall policy

C.The ALG is configured to use proxy-based inspection instead of flow-based

D.The firewall policy has NAT enabled

AnswerB

Without the session helper enabled, FortiGate will not inspect FTP control traffic and will not open pinholes for data connections.

Why this answer

The session helper for FTP is a feature that must be explicitly enabled on the firewall policy to inspect and dynamically create pinholes for active FTP data connections. If the session helper is not enabled on the policy, the firewall will only allow the control session (port 21) but will not open the necessary high ports for the data channel, causing active FTP to fail while passive mode (which uses the control session for data negotiation) may still work.

Exam trap

The trap here is that candidates often assume the FTP session helper is automatically enabled when FTP traffic is allowed, but in FortiGate it must be explicitly configured on the policy, and they may confuse passive mode (which works without helpers) with active mode requirements.

How to eliminate wrong answers

Option A is wrong because passive mode FTP does not require the firewall to open dynamic data ports; instead, the client initiates the data connection, so it would not cause active FTP data connections to be blocked. Option C is wrong because the ALG (Application Layer Gateway) configuration for proxy-based vs flow-based inspection affects how traffic is processed, but the core issue is that the session helper itself is not enabled on the policy, not the inspection mode. Option D is wrong because NAT on the firewall policy does not inherently block active FTP data connections; NAT can be used with FTP helpers and ALGs to handle address translation, but the absence of the session helper is the direct cause of the failure.

Practice this question →

44

MCQhard

You are troubleshooting a VPN phase 2 negotiation failure. The logs show 'no proposal chosen'. What is the MOST likely cause?

A.The remote gateway IP is incorrect

B.The pre-shared key mismatch

C.The IKE version mismatch

D.The phase 2 proposal settings differ between the peers

AnswerD

Mismatched algorithms cause 'no proposal chosen'.

Why this answer

The 'no proposal chosen' error in VPN phase 2 indicates that the IPsec peers could not agree on a common set of phase 2 parameters (such as encryption algorithm, authentication algorithm, or PFS group). Since phase 2 negotiation occurs after IKE phase 1 has successfully completed, the issue is specifically with the IPsec SA proposal settings, not with pre-shared keys or IKE version. Therefore, differing phase 2 proposals between the peers are the most likely cause.

Exam trap

The trap here is that candidates often confuse phase 1 and phase 2 errors, assuming any 'no proposal chosen' relates to IKE proposals, when in fact the error message is specific to the IPsec SA negotiation in phase 2.

How to eliminate wrong answers

Option A is wrong because an incorrect remote gateway IP would prevent phase 1 (IKE) from establishing, not cause a phase 2 'no proposal chosen' error. Option B is wrong because a pre-shared key mismatch would cause an IKE authentication failure during phase 1, not a phase 2 proposal mismatch. Option C is wrong because an IKE version mismatch would prevent phase 1 negotiation entirely, resulting in a different error (e.g., 'no acceptable proposal' during phase 1), not a phase 2-specific 'no proposal chosen'.

Practice this question →

45

MCQmedium

During a failover test in an active-passive HA cluster, the administrator notices that the secondary unit does not take over the primary role after a link failure on the primary. The 'get system ha status' shows both units in 'standalone' mode. What is the MOST likely cause?

A.The session pickup feature is disabled

B.The HA heartbeat interface is down or misconfigured on one unit

C.The cluster is running in active-active mode

D.The HA override feature is disabled

AnswerB

Heartbeat failure causes units to operate independently as standalone.

Why this answer

When both units show 'standalone' mode in 'get system ha status', it indicates that the HA cluster has lost communication between the primary and secondary units, causing them to operate independently. The most common cause is a failure or misconfiguration of the HA heartbeat interface, which is the dedicated link used for cluster synchronization and health monitoring. Without a functional heartbeat, the secondary cannot detect the primary's link failure and will not initiate a failover.

Exam trap

The trap here is that candidates often confuse session pickup or override features with the fundamental requirement of a working heartbeat interface, assuming that failover is triggered by link failure detection on data ports rather than requiring a separate, dedicated heartbeat link.

How to eliminate wrong answers

Option A is wrong because session pickup is a feature for synchronizing existing sessions during a failover, not for detecting link failures or triggering role changes; disabling it does not prevent the secondary from taking over the primary role. Option C is wrong because if the cluster were running in active-active mode, both units would show as 'active' in HA status, not 'standalone', and the question specifies an active-passive cluster. Option D is wrong because the HA override feature controls whether a primary unit can preempt a secondary after recovery, not the ability to detect link failures or perform failover; disabling it does not cause standalone mode.

Practice this question →

46

Multi-Selectmedium

An administrator is troubleshooting an IPsec VPN where phase 1 is up but phase 2 fails. Which two debug commands would be MOST helpful in diagnosing the phase 2 issue? (Choose TWO.)

Select 2 answers

A.diagnose sys session list

B.diagnose debug application ipsec -1

C.diagnose vpn ipsec phase2-config

D.get vpn ipsec tunnel details

E.diagnose debug application ike -1

AnswersC, E

This shows the configured phase 2 parameters, helpful for mismatch detection.

Why this answer

'diagnose vpn ipsec phase2-config' displays the phase 2 configuration parameters (e.g., proxy IDs, encryption/authentication algorithms, and SA lifetimes) that must match between peers. Option E is correct because 'diagnose debug application ike -1' enables real-time IKEv1/IKEv2 debugging, which shows the exact phase 2 negotiation messages (e.g., Quick Mode exchanges) and any error codes or mismatches. Together, they allow you to identify configuration mismatches or negotiation failures that prevent phase 2 from establishing.

Exam trap

The trap here is that candidates confuse 'diagnose debug application ipsec' (which debugs kernel IPsec operations) with 'diagnose debug application ike' (which debugs the IKE negotiation protocol), leading them to select the wrong debug command for phase 2 issues.

Practice this question →

47

MCQeasy

A FortiGate administrator wants to see the current number of active sessions. Which command provides this information?

A.show system session-info

B.diagnose sys session stat

C.diagnose sys session list

D.get system performance status

AnswerB

This command shows session count and other statistics.

Why this answer

The 'diagnose sys session stat' command displays a summary of the current session table, including the total number of active sessions, which is exactly what the administrator needs. This command is part of FortiGate's diagnostic tools and provides a quick statistical overview without listing individual session details.

Exam trap

The trap here is that candidates confuse 'diagnose sys session stat' with 'diagnose sys session list' or 'show system session-info', assuming any command with 'session' in it will show the session count, but only 'stat' provides the aggregated summary without listing every session.

How to eliminate wrong answers

Option A is wrong because 'show system session-info' is not a valid FortiGate CLI command; the correct command for viewing session information is 'diagnose sys session stat' or 'get system session-info' (which shows session-related configuration, not active session counts). Option C is wrong because 'diagnose sys session list' dumps all individual session entries, which is useful for deep inspection but does not provide a simple count of active sessions and can overwhelm the output. Option D is wrong because 'get system performance status' shows overall system performance metrics like CPU and memory usage, not the number of active sessions.

Practice this question →

48

MCQmedium

A site-to-site IPsec VPN tunnel is failing. The administrator runs 'diagnose vpn ike config' and sees that phase 1 parameters are correct. However, phase 2 negotiation fails with 'no proposal chosen'. What is the MOST likely cause?

A.The pre-shared key is incorrect

B.The phase 2 encryption/authentication algorithms do not match between peers

C.The firewall policy allowing IKE traffic is missing

D.The remote gateway IP address is wrong

AnswerB

Phase 2 negotiation fails when proposals do not match.

Why this answer

The 'no proposal chosen' error in phase 2 indicates that the IPsec security association (SA) parameters—specifically the encryption algorithm, authentication algorithm, or Diffie-Hellman group—do not match between the two peers. Since the administrator confirmed phase 1 is correct via 'diagnose vpn ike config', the issue is isolated to phase 2 proposal mismatch, making option B the most likely cause.

Exam trap

The trap here is that candidates often confuse phase 1 and phase 2 failures, assuming any 'no proposal chosen' error relates to IKE phase 1, when in fact the error message specifically indicates a phase 2 proposal mismatch after phase 1 has successfully completed.

How to eliminate wrong answers

Option A is wrong because an incorrect pre-shared key would cause phase 1 (IKE) negotiation to fail, not phase 2; the administrator already verified phase 1 parameters are correct. Option C is wrong because a missing firewall policy for IKE traffic would prevent UDP port 500 or 4500 packets from reaching the FortiGate, blocking phase 1 entirely, not just phase 2. Option D is wrong because an incorrect remote gateway IP address would prevent any IKE communication, leading to a phase 1 failure, not a phase 2 'no proposal chosen' error.

Practice this question →

49

MCQmedium

An administrator wants to troubleshoot why specific traffic is not matching a configured firewall policy. Which debug command should be used?

A.diagnose sys session list

B.get firewall policy <id>

C.diagnose netlink interface list

D.diagnose debug flow

AnswerD

This traces packet flow and shows policy matching.

Why this answer

The 'diagnose debug flow' command is the correct tool for tracing traffic through the firewall policy engine in FortiOS. It captures the packet flow in real time, showing which policy is evaluated, why a match or no-match occurs, and any drop reasons. This directly addresses the administrator's need to troubleshoot why specific traffic is not matching a configured firewall policy.

Exam trap

The trap here is that candidates often confuse session listing commands with flow debugging, assuming that viewing existing sessions ('diagnose sys session list') will reveal why new traffic fails to match a policy, when in fact it only shows already-established sessions and not the real-time policy evaluation path.

How to eliminate wrong answers

Option A is wrong because 'diagnose sys session list' displays existing session entries in the session table, not the policy matching process for new traffic; it shows what has already been matched, not why a match failed. Option B is wrong because 'get firewall policy <id>' only displays the configuration of a specific policy, not the real-time debugging of traffic flow or policy matching decisions. Option C is wrong because 'diagnose netlink interface list' shows interface information and netlink kernel state, which is unrelated to firewall policy matching or traffic debugging.

Practice this question →

50

MCQhard

An administrator runs 'diagnose debug application fnbam -1' and sees messages like 'LB_SELECT: selected server 10.0.0.2:80' but the client connection fails. The FortiGate is configured with server load balancing. What could be the issue?

A.The real server is not reachable or is down

B.The load balancing algorithm is set to least-connection

C.The persistence setting is misconfigured

D.The virtual server IP is overlapping with a physical interface

AnswerA

Correct. The debug shows selection, but the server may not be listening or reachable.

Why this answer

The 'LB_SELECT: selected server 10.0.0.2:80' message indicates that the FortiGate's load-balancing process has chosen a real server for the connection. However, the client connection fails, which points to a problem with the selected server itself. The most common cause is that the real server is unreachable or down, preventing the TCP handshake or HTTP response from completing, even though the load-balancing decision was made successfully.

Exam trap

The trap here is that candidates see 'LB_SELECT' and assume the load-balancing decision is the problem, when in fact the debug output confirms the selection logic is working, and the failure lies in the server's reachability or health.

How to eliminate wrong answers

Option B is wrong because the load-balancing algorithm (e.g., least-connection) affects how servers are selected, not whether the selected server is reachable; the debug message shows a server was selected, so the algorithm is functioning. Option C is wrong because persistence (stickiness) settings control whether subsequent connections from the same client go to the same server, but the initial connection failure is unrelated to persistence misconfiguration. Option D is wrong because an overlapping virtual server IP with a physical interface would typically cause a configuration error or routing issue, not a specific 'selected server' message in the debug output, and the FortiGate would likely reject the VIP configuration or produce different diagnostic messages.

Practice this question →

51

MCQmedium

A FortiGate is configured with multiple BGP peers. One of the peers is not receiving the expected routes. The administrator runs 'get router info bgp neighbors <IP>' and sees that the 'State/PfxRcd' field is 'Active'. What does this indicate?

A.The BGP peer has reached the maximum prefix limit

B.The BGP peer has been administratively shut down

C.The BGP session is in the Active state, meaning the FortiGate is trying to establish a TCP connection to the peer

D.The BGP session has been established and routes are being exchanged

AnswerC

Active state indicates the router is actively trying to initiate a TCP connection to the peer, but the session is not yet up.

Why this answer

The 'Active' state in BGP indicates that the FortiGate has sent an OPEN message and is waiting for a TCP connection from the peer, or is actively retrying the TCP connection. This means the session has not yet reached the Established state, so no routes are being exchanged. Option C correctly identifies that the FortiGate is attempting to establish a TCP connection to the peer.

Exam trap

The trap here is that candidates confuse 'Active' with 'Established' because both sound like the session is working, but 'Active' actually means the TCP connection has not been completed, while 'Established' is the only state where routes are exchanged.

How to eliminate wrong answers

Option A is wrong because the 'State/PfxRcd' field shows 'Active', not 'Idle (PfxCtx)' or a prefix limit exceeded message; the maximum prefix limit would cause the session to go to Idle state, not Active. Option B is wrong because an administratively shut down peer would show 'Idle (Admin)' in the state field, not 'Active'. Option D is wrong because the 'Active' state explicitly means the session is not yet established; routes are only exchanged after the session reaches the 'Established' state, which would show a numeric prefix count in 'State/PfxRcd'.

Practice this question →

52

MCQmedium

An administrator notices high CPU usage on a FortiGate. To identify which process is consuming the most CPU, which command should be used?

A.diagnose sys top

B.diagnose sys session stat

C.get system performance status

D.diagnose hardware sysinfo

AnswerA

This displays a list of processes sorted by CPU usage.

Why this answer

The 'diagnose sys top' command displays a real-time list of running processes on the FortiGate, sorted by CPU usage, allowing the administrator to identify which process is consuming the most CPU. This is the standard diagnostic tool for process-level CPU troubleshooting in FortiOS.

Exam trap

The trap here is that candidates confuse high-level performance commands like 'get system performance status' with process-level diagnostics, but only 'diagnose sys top' provides per-process CPU breakdown.

How to eliminate wrong answers

Option B is wrong because 'diagnose sys session stat' shows session statistics (total sessions, active sessions, etc.), not process-level CPU usage. Option C is wrong because 'get system performance status' provides a high-level summary of CPU and memory utilization but does not break down usage by individual process. Option D is wrong because 'diagnose hardware sysinfo' displays hardware information such as serial numbers, temperatures, and fan status, not process CPU consumption.

Practice this question →

53

MCQeasy

An administrator wants to see the current number of active sessions on a FortiGate. Which command should the admin use?

A.diagnose sys session list

B.diagnose sys session stat

C.get system performance status

D.get system ha status

AnswerB

This command shows session count and other metrics.

Why this answer

The command 'diagnose sys session stat' displays a summary of session statistics, including the total number of active sessions currently tracked by the FortiGate's session table. This is the correct way to quickly see the current active session count without listing every individual session, which would be overwhelming and resource-intensive.

Exam trap

The trap here is that candidates often confuse 'diagnose sys session list' (which shows individual sessions) with 'diagnose sys session stat' (which shows the count), because both commands start with the same prefix and deal with sessions, but only 'stat' gives the aggregate number without flooding the console.

How to eliminate wrong answers

Option A is wrong because 'diagnose sys session list' dumps every individual session entry in the session table, which is useful for deep inspection but not for simply viewing the current number of active sessions; it can also cause high CPU usage on a busy firewall. Option C is wrong because 'get system performance status' shows overall system resource usage (CPU, memory, disk) and basic throughput, but it does not display the session count. Option D is wrong because 'get system ha status' shows High Availability cluster state and synchronization details, which is unrelated to session statistics.

Practice this question →

54

Multi-Selectmedium

An administrator notices that an application-based SD-WAN rule is not steering traffic as expected. The SLA targets are configured correctly. Which TWO debug commands should the administrator use to diagnose the issue? (Choose two.)

Select 2 answers

A.diagnose debug application sslvpn -1

B.get system performance status

C.diagnose sys sdwan info

D.diagnose sys sdwan rule list

E.diagnose sys session filter dport 443 ; diagnose sys session list

AnswersC, E

Displays SD-WAN configuration, member status, and SLA compliance.

Why this answer

'diagnose sys sdwan info' displays the current SD-WAN configuration and status, including SLA targets, interface metrics, and rule assignments, which helps verify if the SD-WAN rule is correctly applied. Option E is correct because filtering session entries by destination port 443 (HTTPS) and listing them shows active traffic flows, allowing the administrator to confirm whether the application traffic is being steered according to the SD-WAN rule or taking an unexpected path.

Exam trap

The trap here is that candidates confuse 'diagnose sys sdwan rule list' with a valid command, when in fact it does not exist in FortiOS, and they overlook the need to inspect actual session flows with 'diagnose sys session list' to confirm traffic steering behavior.

Practice this question →

55

Drag & Dropmedium

Drag and drop the steps to perform a firmware upgrade on a FortiGate device into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

The correct sequence for a FortiGate firmware upgrade is to first back up the configuration, then upload the new firmware image, confirm the upgrade to start the process, and finally verify the upgrade after the device reboots. This ensures configuration safety and successful upgrade completion.

Practice this question →

56

MCQhard

An HA cluster of two FortiGates is experiencing split-brain. After investigation, you find that the heartbeat link is down on the primary unit. Which action will resolve the split-brain condition?

A.Disable HA on both units and re-enable

B.Restore the heartbeat link by checking cables, interfaces, and VLAN configuration

C.Increase the HA priority on the primary unit

D.Reboot the secondary unit

AnswerB

Split-brain is caused by heartbeat failure; restoring the link resolves it.

Why this answer

Split-brain occurs when HA peers lose heartbeat communication and both assume the primary role. Since the root cause is a failed heartbeat link on the primary unit, restoring that link (checking cables, interfaces, VLAN configuration) re-establishes the control channel, allowing the cluster to negotiate roles and resolve the split-brain condition without disrupting services or requiring a full HA reset.

Exam trap

The trap here is that candidates often assume split-brain requires a full HA reset or priority adjustment, when in fact the most direct and least disruptive fix is to restore the failed heartbeat link that caused the condition.

How to eliminate wrong answers

Option A is wrong because disabling and re-enabling HA on both units is a disruptive, brute-force method that does not address the underlying heartbeat link failure; it forces a full HA re-initialization, causing unnecessary traffic interruption and potential configuration loss. Option C is wrong because increasing the HA priority on the primary unit does not fix the lost heartbeat connectivity; priority only influences role election when heartbeat is functional, and with a dead link, both units will still believe they are primary. Option D is wrong because rebooting the secondary unit does not restore the primary's heartbeat link; the secondary will reboot and immediately re-enter split-brain since the primary still cannot communicate over the heartbeat interface.

Practice this question →

57

MCQhard

An administrator configures a session helper for FTP on FortiGate. After enabling the helper, FTP clients can establish control connections but data transfers fail. What is the most likely cause?

A.The firewall policy is configured to deny all FTP traffic

B.The FTP server's certificate is invalid

C.The FTP server is using active mode, which is not supported by the session helper

D.The session helper is not applied to the correct firewall policy or the traffic is not matching the helper

AnswerD

If the helper is not associated with the policy or the traffic doesn't match, the helper won't open data ports.

Why this answer

The session helper for FTP must be explicitly applied to the firewall policy that handles the FTP traffic. If the helper is enabled globally but not associated with the correct policy, or if the traffic does not match the policy (e.g., due to incorrect source/destination or service), the FortiGate will not inspect the control channel to dynamically open data ports. This results in successful control connections (TCP port 21) but failure of data transfers (active or passive), as the helper is not present to create the necessary pinholes for data sessions.

Exam trap

The trap here is that candidates assume enabling a session helper globally is sufficient, but FortiGate requires the helper to be explicitly enabled on the firewall policy that matches the traffic, otherwise the helper's inspection logic is never triggered for that session.

How to eliminate wrong answers

Option A is wrong because if the firewall policy denied all FTP traffic, even the control connection (TCP port 21) would fail, not just data transfers. Option B is wrong because FTP session helpers operate at Layer 4-7 and do not validate server certificates; certificate issues affect FTPS (FTP over SSL/TLS), not plain FTP. Option C is wrong because the FTP session helper supports both active and passive modes; active mode requires the helper to open a reverse data connection from the server to the client, which the helper handles correctly when applied to the policy.

Practice this question →

58

MCQmedium

An SD-WAN rule is configured to steer traffic based on SLA metrics. The administrator notices that traffic is not using the expected member interface even though the SLA is meeting thresholds. What should the administrator check FIRST?

A.Check the firewall policy to ensure SD-WAN is enabled

B.Verify the BGP configuration to ensure routes are being advertised

C.Run 'diagnose sys sdwan info' to verify the rule and member status

D.Restart the FortiGate to clear any stale sessions

AnswerC

This command shows detailed SD-WAN information.

Why this answer

'diagnose sys sdwan info' provides a real-time view of SD-WAN rule status, member interface health, and SLA compliance. This command directly shows whether the rule is matching traffic and if the expected member is active or has been deprioritized due to implicit factors like session stickiness or load-balancing algorithm, which are not visible in the SLA thresholds alone.

Exam trap

The trap here is that candidates assume SLA compliance alone guarantees traffic will use the member, ignoring that SD-WAN rules also consider load-balancing algorithms, session stickiness, and explicit member selection in the rule configuration.

How to eliminate wrong answers

Option A is wrong because SD-WAN rules are independent of firewall policy SD-WAN enablement; the firewall policy only needs to reference the SD-WAN zone, and disabling SD-WAN on the policy would block all SD-WAN steering, not cause a specific member to be unused while SLA is met. Option B is wrong because BGP route advertisement affects routing table entries, not SD-WAN rule-based traffic steering; SD-WAN rules override routing decisions based on SLA metrics, so BGP misconfiguration would not cause a member to be unused if the rule is correctly matching. Option D is wrong because restarting the FortiGate is a drastic, unnecessary step that would clear all sessions but not resolve a configuration or rule-matching issue; stale sessions are not the cause when SLA is meeting thresholds and the member is not being used.

Practice this question →

59

MCQhard

You execute 'diagnose sys session filter dport 443' and see output: 'proto=6 proto_state=01 duration=3600 expire=3599'. What does 'proto_state=01' indicate about this session?

A.The session is in the SYN_SENT state, waiting for SYN-ACK

B.The session is in the FIN_WAIT state

C.The session has completed the three-way handshake

D.The session has been terminated with a RST

AnswerA

Correct. State '01' in FortiOS maps to TCP state SYN_SENT (waiting for SYN-ACK).

Why this answer

In Fortinet's FortiOS, the 'proto_state' field in session diagnostic output represents the TCP state machine. A value of '01' corresponds to the SYN_SENT state (TCP state 1), indicating that the session has sent a SYN packet and is waiting for a SYN-ACK response. This is consistent with the initial phase of a TCP three-way handshake.

Exam trap

Trap: Candidates may misinterpret '01' as the ESTABLISHED state (common TCP state 1 in other contexts) but FortiOS maps TCP state 1 to SYN_SENT, not ESTABLISHED (state 3). The correct TCP state is SYN_SENT (waiting for SYN-ACK).

How to eliminate wrong answers

Option B is wrong because FIN_WAIT is a TCP state (typically state 4 or 5) used during connection teardown, not represented by '01'. Option C is wrong because a completed three-way handshake corresponds to the ESTABLISHED state (TCP state 2, often '02' in FortiOS), not '01'. Option D is wrong because a session terminated with a RST would not have an active 'proto_state' of '01'; it would either be closed or show a different state (e.g., CLOSE_WAIT or TIME_WAIT).

Practice this question →

60

MCQeasy

An administrator is troubleshooting an HA cluster where both units show as primary after a link failure. What is the most likely cause of this split-brain scenario?

A.The HA heartbeat interface is down or misconfigured

B.The priority values are set identically

C.The HA uptime is mismatched between the two units

D.The session pickup feature is disabled

AnswerA

If the heartbeat link fails, each unit assumes the other is dead and transitions to primary.

Why this answer

In a Fortinet HA cluster, the heartbeat interface is responsible for exchanging health and synchronization information between units. If this interface goes down or is misconfigured, the units lose communication and each assumes the other is dead, causing both to transition to the primary state (split-brain). This is the most common cause of split-brain scenarios in FortiGate HA clusters.

Exam trap

The trap here is that candidates often confuse the cause of split-brain with configuration mismatches like priority or session pickup, but the root cause is almost always a loss of heartbeat communication between the cluster members.

How to eliminate wrong answers

Option B is wrong because identical priority values do not cause split-brain; they simply mean the cluster will use other tie-breakers (such as serial number or uptime) to determine the primary. Option C is wrong because mismatched uptime is a normal tie-breaker used when priorities are equal, not a cause of split-brain. Option D is wrong because session pickup is a feature for synchronizing sessions during failover, and disabling it does not affect the HA election process or cause both units to become primary.

Practice this question →

61

MCQhard

An administrator configures SD-WAN with multiple members. The SD-WAN rule uses the 'latency' strategy. The administrator notices that traffic is not switching to the best-performing member even when latency exceeds the threshold. What could be the issue?

A.The SLA target is not configured or not applied to the SD-WAN rule

B.The load balancing algorithm is set to 'source-ip-based'

C.The threshold is set too low

D.The SD-WAN members are in different VDOMs

AnswerA

Without SLA, performance monitoring is not active, so latency strategy has no data to act on.

Why this answer

The latency-based SD-WAN rule requires an SLA target to define acceptable performance thresholds. Without an SLA target configured and applied to the rule, the FortiGate has no baseline to compare against, so it will never trigger a member switch even if latency exceeds the threshold. The SLA target must be linked to the SD-WAN rule via the 'set sla' command in the rule configuration.

Exam trap

The trap here is that candidates assume the 'latency' strategy alone will automatically monitor and switch based on real-time latency, but FortiGate requires an explicit SLA target to define the threshold and trigger the evaluation.

How to eliminate wrong answers

Option B is wrong because the load balancing algorithm (e.g., source-ip-based) affects how traffic is distributed among members under normal conditions, but it does not prevent the latency strategy from switching traffic when the SLA is violated; the latency strategy overrides load balancing for failover decisions. Option C is wrong because setting the threshold too low would cause more frequent switching, not prevent it; the issue is that no switching occurs at all, indicating the threshold is not being evaluated. Option D is wrong because SD-WAN members in different VDOMs are supported as long as inter-VDOM links are properly configured; this would not inherently block SLA-based switching.

Practice this question →

62

Multi-Selecthard

An admin needs to verify that a new firewall policy is performing SSL inspection. Which THREE CLI commands or steps should the admin use to confirm? (Choose three.)

Select 3 answers

A.Use 'diagnose wad filter' to check if traffic is being processed by the web proxy for SSL inspection

B.Run 'diagnose debug flow' to check if traffic is hitting the policy

C.Filter sessions with 'diagnose sys session filter dport 443' and list sessions to see if they are decrypted

D.Run 'get system performance status' to see SSL inspection statistics

E.Check the policy configuration with 'show firewall policy <id>' and look for 'ssl-ssh-profile'

AnswersA, C, E

SSL inspection in proxy mode goes through the WAD daemon; checking WAD confirms inspection.

Why this answer

'diagnose wad filter' is used to verify that traffic is being processed by the web proxy (WAD) for SSL inspection. When SSL inspection is enabled, traffic on port 443 is intercepted by the FortiGate's proxy, and this command filters and displays relevant proxy sessions, confirming that decryption is occurring.

Exam trap

The trap here is that candidates often confuse 'diagnose debug flow' with confirming SSL inspection, but it only verifies policy matching, not the actual decryption process handled by the proxy.

Practice this question →

63

Multi-Selectmedium

An administrator is troubleshooting a scenario where traffic from VLAN 100 to a server at 10.1.2.100 is being blocked. The FortiGate has an active security policy allowing the traffic and the routing table shows a correct route. Which TWO diagnostic commands should the administrator run to identify the cause of the blockage?

Select 2 answers

A.diagnose sniffer packet any 'host 10.1.2.100' 4

B.get system performance status

C.diagnose ip arp list

D.diagnose sys session list

E.diagnose debug flow

AnswersA, E

Captures packets to verify traffic reaches the FortiGate.

Why this answer

'diagnose sniffer packet any host 10.1.2.100 4' captures packets to/from the server at the interface level, allowing the administrator to see if traffic from VLAN 100 is actually arriving at the FortiGate and whether it is being dropped or forwarded. This command helps identify if the issue is at Layer 2 (e.g., VLAN misconfiguration) or Layer 3 (e.g., routing or firewall drops).

Exam trap

The trap here is that candidates often choose 'diagnose sys session list' thinking it shows blocked traffic, but it only lists established sessions, not dropped packets or failed session creation attempts.

Practice this question →

64

Multi-Selecteasy

An administrator needs to troubleshoot an HA synchronization issue. Which TWO commands provide information about the HA synchronization status?

Select 2 answers

A.diagnose hardware sysinfo

B.show system ha

C.diagnose ha dump

D.get system ha status

E.diagnose sys session stat

AnswersC, D

Dumps detailed HA synchronization data.

Why this answer

The 'diagnose ha dump' command (C) provides detailed internal HA state information, including synchronization status, heartbeat details, and failover counters, which is essential for deep troubleshooting. The 'get system ha status' command (D) displays the current HA operational status, including synchronization state (e.g., 'synchronized' or 'out of sync'), making it a direct tool for checking sync health.

Exam trap

The trap here is that candidates confuse 'show system ha' (which only shows configuration) with 'get system ha status' (which shows operational synchronization state), or they overlook 'diagnose ha dump' because it sounds too low-level, even though it provides the most granular sync diagnostics.

Practice this question →

65

MCQmedium

A FortiGate admin runs 'diagnose debug application sslvpn -1' and sees repeated messages: 'SSL VPN tunnel establishment failed: no response from client.' The remote user reports that the FortiClient VPN connects but no traffic passes. What is the MOST likely cause?

A.The SSL VPN realm is misconfigured

B.The SSL VPN certificate has expired

C.The remote user's FortiClient version is incompatible

D.A firewall on the remote user's network is blocking UDP port 4500 or TCP port 443

AnswerD

SSL VPN tunnel establishment requires UDP 4500 (for NAT traversal) or TCP 443 for initial handshake. If blocked, the client cannot respond, leading to the 'no response from client' message.

Why this answer

The 'no response from client' message indicates the FortiGate is not receiving the expected reply from the client during SSL VPN tunnel establishment. This typically occurs when a firewall on the remote user's network blocks UDP port 4500 (IPsec NAT traversal) or TCP port 443 (HTTPS control channel), preventing the FortiClient from completing the tunnel negotiation. The fact that the client 'connects' but no traffic passes suggests the initial SSL handshake succeeds, but the subsequent tunnel setup fails due to packet loss or filtering.

Exam trap

The trap here is that candidates assume 'connects' means the entire VPN is working, when in reality FortiClient can show a connected status after the HTTPS phase completes even if the IPsec data tunnel fails due to UDP port blocking.

How to eliminate wrong answers

Option A is wrong because a misconfigured SSL VPN realm would cause authentication or portal access failures, not a 'no response from client' error during tunnel establishment. Option B is wrong because an expired SSL VPN certificate would produce certificate validation errors in the debug output, not a timeout waiting for client response. Option C is wrong because an incompatible FortiClient version typically causes version mismatch errors or connection refusal, not a silent failure where the client appears to connect but no traffic passes.

Practice this question →

66

MCQmedium

A network administrator runs the command 'diagnose debug application ssl -1' and sees the following output: 'ssl_generate_proxy_cert: cannot find CA certificate for issuer CN=www.example.com'. What is the MOST likely cause?

A.The FortiGate does not have an internet connection to reach the CA certificate authority

B.The firewall policy does not have SSL inspection enabled

C.The web server's certificate has expired

D.The SSL/SSH inspection profile is configured with an incorrect CA certificate

AnswerD

If the CA certificate used to sign proxy certificates is missing or invalid, FortiGate cannot generate a new certificate for the inspected site.

Why this answer

The error 'cannot find CA certificate for issuer CN=www.example.com' indicates that the FortiGate's SSL/SSH inspection profile is configured to use a specific CA certificate to re-sign the web server's certificate, but that CA certificate is not present in the FortiGate's certificate store. This occurs when the inspection profile references a CA certificate that has been deleted, not imported, or misconfigured, preventing the generation of a proxy certificate for SSL inspection.

Exam trap

Fortinet often tests the misconception that SSL inspection errors are caused by network connectivity issues or certificate expiry, but the specific error about a missing CA certificate points directly to a misconfiguration in the inspection profile's certificate settings.

How to eliminate wrong answers

Option A is wrong because the FortiGate does not need an internet connection to reach a CA certificate authority; the CA certificate used for SSL inspection is locally stored on the FortiGate, not fetched from an external CA. Option B is wrong because if the firewall policy did not have SSL inspection enabled, the debug output would not show an attempt to generate a proxy certificate; the error specifically arises during the SSL inspection process, which requires the feature to be enabled. Option C is wrong because an expired web server certificate would cause a different error, such as 'certificate has expired' or a TLS handshake failure, not a missing CA certificate for re-signing.

Practice this question →

67

MCQeasy

A FortiGate administrator wants to check if the device is experiencing high CPU usage due to a specific process. Which command should they use to display real-time process CPU usage?

A.show system resource

B.diagnose sys top

C.get system performance status

D.diagnose debug application crashlog read

AnswerB

Shows real-time process list with CPU usage.

Why this answer

The 'diagnose sys top' command provides a real-time, top-like view of FortiGate processes, showing CPU and memory usage per process. This allows the administrator to identify which specific process is consuming high CPU, making it the correct choice for this diagnostic task.

Exam trap

The trap here is that candidates often confuse 'show system resource' (overall stats) with per-process diagnostics, or they mistakenly think 'get system performance status' provides process-level detail, when it only shows aggregate performance metrics.

How to eliminate wrong answers

Option A is wrong because 'show system resource' displays overall system resource usage (CPU, memory, disk) but does not break down usage by individual process. Option C is wrong because 'get system performance status' shows aggregate performance statistics (e.g., sessions, CPU load average) without per-process detail. Option D is wrong because 'diagnose debug application crashlog read' is used to read crash logs for debugging crashes, not for monitoring real-time process CPU usage.

Practice this question →

68

MCQmedium

When troubleshooting an IPsec VPN phase 1 negotiation failure, which debug command should the administrator run to see detailed IKE negotiation messages?

A.diagnose vpn ike log

B.diagnose debug application ike -1

C.get vpn ipsec tunnel details

D.diagnose debug application ipsec -1

AnswerB

This enables IKE debug with level -1 for verbose output.

Why this answer

The command 'diagnose debug application ike -1' enables detailed IKE (Internet Key Exchange) debug messages in FortiOS, which are essential for troubleshooting Phase 1 negotiation failures. This command captures the full IKE negotiation exchange, including proposals, authentication, and Diffie-Hellman group selection, allowing the administrator to identify where the failure occurs.

Exam trap

The trap here is that candidates often confuse the IKE debug command with the IPsec debug command, mistakenly thinking 'diagnose debug application ipsec -1' will show Phase 1 negotiation details, when in fact it only shows kernel-level IPsec processing and not the IKE control-plane messages.

How to eliminate wrong answers

Option A is wrong because 'diagnose vpn ike log' is not a valid FortiOS command; the correct command uses 'diagnose debug application ike' with a debug level. Option C is wrong because 'get vpn ipsec tunnel details' only displays the current state and configuration of established tunnels, not the real-time IKE negotiation messages needed for troubleshooting Phase 1 failures. Option D is wrong because 'diagnose debug application ipsec -1' debugs the IPsec kernel-level processing (e.g., encryption/decryption), not the IKE control-plane negotiation, so it will not show Phase 1 messages.

Practice this question →

69

MCQhard

Based on the exhibit, what can be concluded about the session?

A.The session is a one-way session with only outbound traffic.

B.The session is not being logged.

C.The session is offloaded to the NPU for hardware acceleration.

D.The session is in the 'npu' state, meaning it is being processed by the CPU.

AnswerC

The 'npu' flag indicates hardware offloading to the network processor.

Why this answer

The session state 'npu' indicates that the session has been offloaded to the Network Processor Unit (NPU) for hardware acceleration. This is a normal and expected state for traffic that matches hardware-offloadable profiles, allowing the NPU to process packets at wire speed without CPU intervention.

Exam trap

The trap here is that candidates often confuse the 'npu' state with CPU processing, assuming it means 'NPU processing by CPU' rather than recognizing it as hardware offload, leading them to select Option D incorrectly.

How to eliminate wrong answers

Option A is wrong because the session state 'npu' does not imply one-way or only outbound traffic; it simply indicates hardware offload, and sessions can be bidirectional. Option B is wrong because the session state 'npu' does not indicate whether logging is enabled or disabled; logging is configured separately via firewall policies or session log settings. Option D is wrong because the 'npu' state means the session is offloaded to the NPU for hardware acceleration, not that it is being processed by the CPU; CPU processing would be indicated by states like 'tcp' or 'udp' without offload.

Practice this question →

70

MCQmedium

An administrator is troubleshooting a split-brain situation in an HA cluster. They run 'get system ha status' and see that both FortiGates report themselves as primary. Which command should they run to force the secondary unit to take over as primary?

A.execute ha failover

B.reboot the primary unit

C.diagnose sys ha reset-uptime

D.diagnose sys ha stop

AnswerC

Resets the uptime, which can trigger a priority re-evaluation and failover.

Why this answer

'diagnose sys ha reset-uptime' resets the HA uptime counter on the local unit. In Fortinet HA, during a split-brain, both units have the same priority and uptime may be a tiebreaker. To force the secondary to become primary, the administrator should run this command on the current primary to reset its uptime counter to zero.

This makes the secondary's uptime higher, so when the next HA election occurs (e.g., after a link flap or manual trigger), the secondary will be elected as the new primary, resolving the split-brain condition.

Exam trap

The trap here is that candidates often confuse 'diagnose sys ha reset-uptime' with a command that directly forces a role change, when in reality it manipulates the uptime tiebreaker to indirectly influence the election process after a failover event.

How to eliminate wrong answers

Option A is wrong because 'execute ha failover' forces the current primary to become secondary and the secondary to become primary, but in a split-brain where both units think they are primary, this command on either unit will not resolve the conflict—it may cause both to attempt failover simultaneously, worsening the split-brain. Option B is wrong because rebooting the primary unit will temporarily remove it from the cluster, but the secondary (also claiming primary) will remain, and upon reboot, the original primary may rejoin as primary again, perpetuating the split-brain unless the underlying cause (e.g., heartbeat failure) is addressed. Option D is wrong because 'diagnose sys ha stop' halts the HA process on the unit it is run on, effectively removing it from the cluster, but it does not force the other unit to become the sole primary; it simply stops HA functionality, which can lead to a loss of redundancy and does not resolve the split-brain state.

Practice this question →

71

MCQeasy

A FortiGate is set up in a high availability (HA) cluster. The administrator notices that the primary unit is not synchronizing configuration changes to the secondary unit. The HA status shows 'synchronization failed'. What is the most likely cause?

A.The firmware versions are different on the two units.

B.The HA heartbeat interface is down.

C.NAT policies are misconfigured.

D.The configuration has not been saved on the primary unit.

AnswerD

HA sync only occurs after the configuration is saved; unsaved changes are not synchronized.

Why this answer

FortiGate HA requires the configuration to be saved (via 'execute backup config' or 'write memory') on the primary unit before it can be synchronized to the secondary unit. If the configuration is not saved, the primary unit does not have a committed configuration to push, leading to a 'synchronization failed' status even though the HA cluster is otherwise healthy.

Exam trap

The trap here is that candidates often assume HA synchronization issues are always caused by network or heartbeat problems, overlooking the fundamental requirement that the configuration must be saved before it can be synchronized.

How to eliminate wrong answers

Option A is wrong because FortiGate HA requires both units to run the same firmware version; if they differ, the cluster will not form at all or will show 'version mismatch', not just a synchronization failure. Option B is wrong because if the HA heartbeat interface is down, the cluster would show 'heartbeat lost' or 'standalone' status, not 'synchronization failed'—the units would not be able to communicate at all. Option C is wrong because NAT policies are a data-plane configuration and do not affect HA configuration synchronization, which is a control-plane function.

Practice this question →

72

MCQmedium

You are troubleshooting an SD-WAN rule where traffic is not matching the expected SLA. The FortiGate shows 'SLA mismatch' in logs. What is the MOST likely cause?

A.The interface is down

B.The SLA probe server is unreachable

C.The measured SLA values exceed the configured thresholds

D.The SD-WAN rule is not enabled

AnswerC

SLA mismatch occurs when the probe results do not meet the thresholds.

Why this answer

The 'SLA mismatch' log indicates that the measured SLA values (e.g., jitter, latency, packet loss) for the traffic have exceeded the configured thresholds in the SD-WAN rule. This causes the FortiGate to consider the link as not meeting the SLA, even though the interface is up and the probe server is reachable. The SD-WAN rule itself is enabled, but the traffic is steered away from the preferred member because the SLA is not satisfied.

Exam trap

The trap here is that candidates often confuse 'SLA mismatch' with a connectivity issue (interface down or probe unreachable), but the log specifically indicates that the link is up and probes are responding, just not within the acceptable performance thresholds.

How to eliminate wrong answers

Option A is wrong because if the interface were down, the log would show 'interface down' or 'link down', not 'SLA mismatch'. Option B is wrong because an unreachable SLA probe server would generate 'probe failure' or 'server unreachable' logs, not 'SLA mismatch'. Option D is wrong because if the SD-WAN rule were not enabled, the traffic would not be evaluated against SLA thresholds at all, and no 'SLA mismatch' log would appear.

Practice this question →

73

MCQhard

Based on the debug flow output, what is the reason the packet is dropped?

A.The route to the destination is missing.

B.There is no firewall policy that matches the traffic.

C.The packet has an invalid source IP address.

D.The session table is full.

AnswerB

The message 'no matching policy' clearly states this.

Why this answer

The debug flow output indicates that the packet was dropped because no firewall policy matched the traffic. In FortiGate, even if a valid route exists, the packet must be evaluated against firewall policies; if no policy permits the traffic based on source, destination, service, and interface, the packet is silently dropped. The debug flow will show a message like 'no matching policy' or 'deny by policy' in such cases.

Exam trap

The trap here is that candidates often assume a packet drop is due to a missing route when the debug flow shows a policy drop, because they overlook that FortiGate processes routing before policies and the debug flow output explicitly indicates the stage where the drop occurred.

How to eliminate wrong answers

Option A is wrong because a missing route would cause a different debug flow message, such as 'no route to destination' or 'route lookup failed', and the packet would be dropped at the routing stage, not at the firewall policy stage. Option C is wrong because an invalid source IP address (e.g., RFC 1918 on a public interface) would typically be dropped by antispoofing checks or a specific firewall policy, not by a generic 'no matching policy' message; the debug flow would show 'invalid source' or 'reverse path check failed'. Option D is wrong because a full session table would cause a 'session table full' or 'no session available' message in the debug flow, and the drop would occur during session creation, not during policy lookup.

Practice this question →

74

MCQeasy

An HA cluster of two FortiGates is experiencing split-brain. Which command should the administrator use to check the current HA status and identify which unit is the primary?

A.diagnose debug application had 0

B.diagnose sys ha dump

C.get system ha status

D.show system ha

AnswerC

Standard command to show HA status and role.

Why this answer

The correct command to check the current HA status and identify the primary unit is 'get system ha status'. This command displays the HA mode, cluster state, role (primary/secondary), and peer status in a clear, human-readable format. In a split-brain scenario, the administrator needs to quickly confirm which unit believes it is the primary, and this command provides that information directly without debug-level verbosity.

Exam trap

The trap here is that candidates confuse FortiGate CLI syntax with Cisco IOS, where 'show' is used for operational status, but FortiGate uses 'get' for such queries, and they may also mistake debug commands (like 'diagnose debug application had 0') for status-checking commands.

How to eliminate wrong answers

Option A is wrong because 'diagnose debug application had 0' enables debug logging for the HA daemon at debug level 0, which is used for troubleshooting HA protocol issues but does not display a concise status summary or identify the primary unit. Option B is wrong because 'diagnose sys ha dump' outputs raw internal HA state data, including timers and counters, which is too verbose and not intended for quickly checking primary/secondary status. Option D is wrong because 'show system ha' is not a valid FortiGate CLI command; the correct syntax uses 'get' (e.g., 'get system ha status') for operational state retrieval, while 'show' is used in other vendors like Cisco.

Practice this question →

75

MCQmedium

A FortiGate admin notices that HTTPS traffic to a web server is not being scanned by the antivirus profile applied to the firewall policy. The admin confirms the policy is correct and antivirus is enabled. What is the MOST likely reason the traffic is not being scanned?

A.SSL/TLS deep inspection is not enabled on the firewall policy

B.The web server's certificate is self-signed and FortiGate is rejecting the connection

C.The FortiGuard antivirus subscription has expired

D.The antivirus profile is configured for flow-based inspection instead of proxy-based

AnswerA

HTTPS traffic is encrypted. FortiGate cannot inspect the payload without SSL deep inspection decrypting the TLS session. The antivirus profile requires inspection mode to be enabled.

Why this answer

When HTTPS traffic is not scanned by an antivirus profile despite the policy being correct and antivirus enabled, the most likely cause is that SSL/TLS deep inspection is not enabled on the firewall policy. Without deep inspection, FortiGate cannot decrypt the encrypted HTTPS payload, so the antivirus engine sees only encrypted data and cannot scan for malware. Enabling deep inspection with a valid CA certificate allows FortiGate to perform man-in-the-middle decryption and then apply antivirus scanning to the decrypted content.

Exam trap

The trap here is that candidates often assume antivirus scanning works on all traffic by default, but they overlook the critical prerequisite of SSL/TLS deep inspection to decrypt HTTPS before scanning can occur.

How to eliminate wrong answers

Option B is wrong because a self-signed certificate would cause FortiGate to reject the connection only if the firewall policy has SSL certificate inspection set to 'certificate-inspection' or 'deep-inspection' with an untrusted CA; if deep inspection is not enabled, FortiGate simply passes the encrypted traffic without scanning, regardless of certificate trust. Option C is wrong because an expired FortiGuard antivirus subscription would prevent signature updates but would not stop scanning of already-decrypted traffic; the antivirus engine would still attempt to scan using the last known signatures. Option D is wrong because flow-based vs proxy-based inspection affects how the antivirus engine processes traffic (flow-based uses pattern matching on the fly, proxy-based buffers and reassembles), but both modes require decrypted traffic to scan HTTPS; if deep inspection is not enabled, neither mode can scan the encrypted payload.

Practice this question →

Page 1 of 2 · 141 questions totalNext →

Ready to test yourself?

Try a timed practice session using only Nse7 Troubleshooting questions.

Start 20-question session