How should I use these Troubleshooting and Diagnostics practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just Troubleshooting and Diagnostics questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Troubleshooting and Diagnostics domain.

NSE7 · topic practice

Troubleshooting and Diagnostics practice questions

Practise Fortinet NSE 7 Advanced Security NSE7 Troubleshooting and Diagnostics practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: Troubleshooting and Diagnostics

Practice 10 questions Browse domain →

What the exam tests

What to know about Troubleshooting and Diagnostics

Troubleshooting and Diagnostics questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Troubleshooting and Diagnostics exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Troubleshooting and Diagnostics questions

20 questions · select your answer, then reveal the explanation

Question 1mediummultiple choice

Review the full subnetting walkthrough →

A FortiGate administrator notices that traffic from a specific subnet is being dropped unexpectedly. The security policy allows the traffic, and there are no firewall policies blocking it. What is the most efficient first step to identify the cause of the drops?

Trap 1: Run 'diagnose debug flow' with the source IP and look for 'no…

Debug flow is useful but may not show drops that occur before policy matching, such as route issues.

Trap 2: Enable 'deny-log' on all policies and check logs for the subnet.

If traffic is not matched by any policy, deny-log won't capture it.

Trap 3: Enable global traffic logging and review logs after some traffic…

Global logging may generate excessive logs and not pinpoint the issue quickly.

Study all Troubleshooting and Diagnostics common traps →

A
Use the 'diag sniffer packet any "host 10.0.1.0/24" 4' command to capture packets and analyze where they are dropped.
Packet sniffer with filter can capture the actual packets and show the drop reason in the output.
B
Run 'diagnose debug flow' with the source IP and look for 'no matching policy' or 'dropped' messages.
Why wrong: Debug flow is useful but may not show drops that occur before policy matching, such as route issues.
C
Enable 'deny-log' on all policies and check logs for the subnet.
Why wrong: If traffic is not matched by any policy, deny-log won't capture it.
D
Enable global traffic logging and review logs after some traffic passes.
Why wrong: Global logging may generate excessive logs and not pinpoint the issue quickly.

Full breakdown with real-world context →

Question 2hardmulti select

Review the full OSPF breakdown →

An organization uses FortiGate with OSPF and BGP. Recently, routes from BGP are not being preferred over OSPF routes, causing suboptimal routing. The administrator wants to ensure BGP routes are preferred. Which two actions can achieve this? (Choose two.)

Trap 1: Configure route-map to set metric to 1 on BGP routes.

Metric is a different attribute and not used for comparing different routing protocols.

Trap 2: Set a higher weight on BGP routes for the prefixes.

Weight influences BGP best path selection but does not affect comparison with OSPF.

Study all Troubleshooting and Diagnostics common traps →

A
Decrease the administrative distance of BGP routes to 5.
Decreasing BGP AD to 5 makes it more preferred over OSPF AD 110.
B
Configure route-map to set metric to 1 on BGP routes.
Why wrong: Metric is a different attribute and not used for comparing different routing protocols.
C
Increase the administrative distance of OSPF routes to 120.
Increasing OSPF AD to 120 makes BGP (AD 20) more preferred.
D
Set a higher weight on BGP routes for the prefixes.
Why wrong: Weight influences BGP best path selection but does not affect comparison with OSPF.

Full breakdown with real-world context →

Question 3easymultiple choice

Read the full Troubleshooting and Diagnostics explanation →

A FortiGate is experiencing high CPU usage. The administrator runs 'diagnose sys top' and sees that the process 'ipsengine' is using the most CPU. What is the most likely cause?

Trap 1: The firewall is experiencing a memory leak.

Memory leaks cause high memory usage, not necessarily high CPU by ipsengine.

Trap 2: The antivirus engine is scanning large files.

Antivirus uses a separate process, not ipsengine.

Trap 3: There is a routing loop causing packet bouncing.

Routing loops affect forwarding plane, not ipsengine.

Study all Troubleshooting and Diagnostics common traps →

A
The firewall is experiencing a memory leak.
Why wrong: Memory leaks cause high memory usage, not necessarily high CPU by ipsengine.
B
A large volume of traffic is being inspected by IPS, possibly due to a DoS attack.
IPS engine uses CPU for deep packet inspection; high volume or many signatures increases load.
C
The antivirus engine is scanning large files.
Why wrong: Antivirus uses a separate process, not ipsengine.
D
There is a routing loop causing packet bouncing.
Why wrong: Routing loops affect forwarding plane, not ipsengine.

Full breakdown with real-world context →

Question 4mediummulti select

Read the full VPN explanation →

An administrator is troubleshooting a VPN tunnel that is not coming up. The remote peer is a third-party device. Which THREE actions should be taken to diagnose the issue?

Trap 1: Confirm that UDP ports 500 and 4500 are not blocked by any firewall.

This should be checked, but it's not one of the three most direct actions for a tunnel not coming up; it's more about network path.

Trap 2: Review the routing table to ensure the remote subnet is reachable…

This is relevant after the tunnel is established.

Study all Troubleshooting and Diagnostics common traps →

A
Ensure that the pre-shared key matches on both sides.
Mismatched PSK is a common cause of tunnel failure.
B
Confirm that UDP ports 500 and 4500 are not blocked by any firewall.
Why wrong: This should be checked, but it's not one of the three most direct actions for a tunnel not coming up; it's more about network path.
C
Verify that the remote peer's IP address is reachable via ping.
Basic connectivity must exist before IKE negotiation.
D
Check the IPSec VPN logs with 'diag debug application ike -1'.
IKE debug shows detailed negotiation steps.
E
Review the routing table to ensure the remote subnet is reachable through the tunnel interface.
Why wrong: This is relevant after the tunnel is established.

Full breakdown with real-world context →

Question 5easymultiple choice

Read the full Troubleshooting and Diagnostics explanation →

A FortiGate administrator sees the following kernel log: 'kernel: [pid 1234] received packet with unknown or unsupported protocol 0x0800 on interface port1, drop'. What does this log indicate?

Trap 1: The packet is an ARP request that failed.

ARP uses protocol type 0x0806.

Trap 2: The packet has an invalid MAC address.

MAC address issues generate different logs.

Trap 3: The packet has IP options set that are not supported.

IP options would be handled at a higher layer.

Study all Troubleshooting and Diagnostics common traps →

A
The packet is an ARP request that failed.
Why wrong: ARP uses protocol type 0x0806.
B
The packet has an invalid MAC address.
Why wrong: MAC address issues generate different logs.
C
The interface is not configured with an IP address or is in the wrong VDOM.
The kernel drops packets when the interface is not configured to handle that protocol.
D
The packet has IP options set that are not supported.
Why wrong: IP options would be handled at a higher layer.

Full breakdown with real-world context →

Question 6hardmultiple choice

Read the full Troubleshooting and Diagnostics explanation →

Based on the debug flow output, what is the reason the packet is dropped?

Exhibit

Refer to the exhibit.

```
diagnose debug flow filter saddr 10.0.1.100
diagnose debug flow filter daddr 10.0.2.200
diagnose debug flow trace start 100
diagnose debug enable

# Output:
id=20085 trace_id=1 func=print_pkt_detail line=5757 msg="vd-root:0 received a packet from port1. src=10.0.1.100 dst=10.0.2.200 sport=12345 dport=80 proto=6"
id=20085 trace_id=1 func=resolve_ip_tuple line=3485 msg="tuple: 10.0.1.100->10.0.2.200, vd=0"
id=20085 trace_id=1 func=fw_pre_route_handler line=162 msg="no matching policy"
id=20085 trace_id=1 func=run_fw_handler line=59 msg="packet dropped"
```

Trap 1: The route to the destination is missing.

No routing-related messages appear in the output.

Trap 2: The packet has an invalid source IP address.

The debug shows no validation issue with the source IP.

Trap 3: The session table is full.

Session table full would show a different error.

Study all Troubleshooting and Diagnostics common traps →

A
The route to the destination is missing.
Why wrong: No routing-related messages appear in the output.
B
There is no firewall policy that matches the traffic.
The message 'no matching policy' clearly states this.
C
The packet has an invalid source IP address.
Why wrong: The debug shows no validation issue with the source IP.
D
The session table is full.
Why wrong: Session table full would show a different error.

Full breakdown with real-world context →

Question 7easymultiple choice

Read the full Troubleshooting and Diagnostics explanation →

An administrator applies the above policy but users from 10.0.1.0/24 cannot access web servers at 10.0.2.0/24. However, they can ping the servers. What is the most likely cause?

Exhibit

Refer to the exhibit.

```
config firewall policy
    edit 1
        set name "Allow Web"
        set srcintf "port1"
        set dstintf "port2"
        set srcaddr "10.0.1.0/24"
        set dstaddr "10.0.2.0/24"
        set action accept
        set schedule "always"
        set service "HTTP"
        set logtraffic all
    next
end
```

Trap 1: The destination address is incorrect.

The policy specifies 10.0.2.0/24, which matches the servers.

Trap 2: The schedule 'always' is not correctly configured.

'always' is a valid schedule that applies at all times.

Trap 3: The source interface is incorrect.

The policy specifies port1, and if users are on port1, it should match.

Study all Troubleshooting and Diagnostics common traps →

A
The service 'HTTP' does not include port 443 or the web application is using HTTPS.
The service 'HTTP' only covers port 80; if the web server uses HTTPS (port 443), the policy won't match.
B
The destination address is incorrect.
Why wrong: The policy specifies 10.0.2.0/24, which matches the servers.
C
The schedule 'always' is not correctly configured.
Why wrong: 'always' is a valid schedule that applies at all times.
D
The source interface is incorrect.
Why wrong: The policy specifies port1, and if users are on port1, it should match.

Full breakdown with real-world context →

Question 8mediummulti select

Review the full routing breakdown →

A FortiGate is experiencing high latency on traffic passing through it. The administrator suspects that asymmetric routing is occurring. Which TWO symptoms are indicative of asymmetric routing?

Trap 1: The routing table shows multiple equal-cost paths to the same…

ECMP can cause load sharing but not necessarily asymmetric routing issues.

Trap 2: Traffic matching a policy is logged as allowed but the application…

This could be due to many reasons, not specific to asymmetric routing.

Trap 3: CPU usage is consistently above 90% during peak hours.

High CPU has many causes, not specifically asymmetric routing.

Study all Troubleshooting and Diagnostics common traps →

A
The routing table shows multiple equal-cost paths to the same destination.
Why wrong: ECMP can cause load sharing but not necessarily asymmetric routing issues.
B
Traffic from the same source IP arrives on different interfaces for different sessions.
This indicates that the return traffic may be arriving on a different interface than expected.
C
Traffic matching a policy is logged as allowed but the application does not work.
Why wrong: This could be due to many reasons, not specific to asymmetric routing.
D
CPU usage is consistently above 90% during peak hours.
Why wrong: High CPU has many causes, not specifically asymmetric routing.
E
The firewall logs show TCP SYN packets but no corresponding SYN-ACK packets for the same session.
Asymmetric routing can cause the SYN-ACK to take a different path, bypassing the firewall.

Full breakdown with real-world context →

Question 9hardmultiple choice

Read the full Troubleshooting and Diagnostics explanation →

A FortiGate cluster (A-P) has a session that is not synchronizing to the secondary unit. The administrator runs 'diagnose sys ha session-sync status' and sees that the session count is different between primary and secondary. Which is the most likely cause?

Trap 1: The session is using a custom application control profile that…

Application control profiles do not affect session sync.

Trap 2: The HA heartbeat interface is down.

If heartbeat is down, no synchronization would occur at all.

Trap 3: The secondary unit has insufficient memory to accept new sessions.

Memory issues would cause more widespread problems.

Study all Troubleshooting and Diagnostics common traps →

A
The session is using a custom application control profile that prevents synchronization.
Why wrong: Application control profiles do not affect session sync.
B
The HA heartbeat interface is down.
Why wrong: If heartbeat is down, no synchronization would occur at all.
C
The secondary unit has insufficient memory to accept new sessions.
Why wrong: Memory issues would cause more widespread problems.
D
The session was created by a local-in traffic (e.g., management traffic) which is not synchronized.
Local-in sessions are typically not synced across HA members.

Full breakdown with real-world context →

Question 10mediummultiple choice

Review the full subnetting walkthrough →

A customer reports intermittent connectivity issues between two internal subnets separated by a FortiGate firewall. The traffic is allowed by the policy, but users experience timeouts during peak hours. Which troubleshooting step should you take first?

Trap 1: Run a packet sniffer on the FortiGate to capture traffic between…

Packet capture is useful but more resource-intensive; should be done after simpler checks.

Trap 2: Disable hardware acceleration on the FortiGate.

This could reduce performance and is not a first step in troubleshooting intermittent connectivity.

Trap 3: Configure SNAT on the policy to translate the source IP.

SNAT is not a troubleshooting step and may not resolve the issue.

Study all Troubleshooting and Diagnostics common traps →

A
Run a packet sniffer on the FortiGate to capture traffic between the subnets.
Why wrong: Packet capture is useful but more resource-intensive; should be done after simpler checks.
B
Check the session table for session limits and session congestion.
Peak hour timeouts often indicate session table exhaustion; checking this is the quickest diagnostic step.
C
Disable hardware acceleration on the FortiGate.
Why wrong: This could reduce performance and is not a first step in troubleshooting intermittent connectivity.
D
Configure SNAT on the policy to translate the source IP.
Why wrong: SNAT is not a troubleshooting step and may not resolve the issue.

Full breakdown with real-world context →

Question 11hardmultiple choice

Read the full VPN explanation →

An administrator is troubleshooting a scenario where IPSec VPN tunnels between two FortiGates are flapping. The logs show Phase 1 is up but Phase 2 fails with 'no proposal chosen'. The remote FortiGate has multiple Phase 2 selectors configured. What is the most likely cause?

Trap 1: Mismatched pre-shared keys.

Pre-shared key mismatch would cause Phase 1 to fail, not Phase 2.

Trap 2: Dead Peer Detection (DPD) settings are too aggressive.

DPD issues would cause the tunnel to drop after being established, not a Phase 2 failure.

Trap 3: Certificate validation failure.

Certificate issues would affect Phase 1 if certificate authentication is used, but logs show Phase 1 is up.

Study all Troubleshooting and Diagnostics common traps →

A
Mismatched Phase 2 proxy IDs (local/remote subnets).
The error 'no proposal chosen' is often due to mismatched proxy IDs in Phase 2.
B
Mismatched pre-shared keys.
Why wrong: Pre-shared key mismatch would cause Phase 1 to fail, not Phase 2.
C
Dead Peer Detection (DPD) settings are too aggressive.
Why wrong: DPD issues would cause the tunnel to drop after being established, not a Phase 2 failure.
D
Certificate validation failure.
Why wrong: Certificate issues would affect Phase 1 if certificate authentication is used, but logs show Phase 1 is up.

Full breakdown with real-world context →

Question 12easymultiple choice

Read the full Troubleshooting and Diagnostics explanation →

A FortiGate is set up in a high availability (HA) cluster. The administrator notices that the primary unit is not synchronizing configuration changes to the secondary unit. The HA status shows 'synchronization failed'. What is the most likely cause?

Trap 1: The firmware versions are different on the two units.

Firmware mismatch would prevent HA from forming at all.

Trap 2: The HA heartbeat interface is down.

A down heartbeat interface would cause cluster split, not just sync failure.

Trap 3: NAT policies are misconfigured.

NAT policies do not affect HA synchronization.

Study all Troubleshooting and Diagnostics common traps →

A
The firmware versions are different on the two units.
Why wrong: Firmware mismatch would prevent HA from forming at all.
B
The HA heartbeat interface is down.
Why wrong: A down heartbeat interface would cause cluster split, not just sync failure.
C
NAT policies are misconfigured.
Why wrong: NAT policies do not affect HA synchronization.
D
The configuration has not been saved on the primary unit.
HA sync only occurs after the configuration is saved; unsaved changes are not synchronized.

Full breakdown with real-world context →

Question 13mediummulti select

Read the full Troubleshooting and Diagnostics explanation →

Which TWO actions are appropriate when troubleshooting a slow network connection through a FortiGate?

Trap 1: Increase the session TTL to reduce session setup overhead.

Changing session TTL does not address root cause and may exhaust resources.

Trap 2: Disable flow control on the WAN interface.

Disabling flow control can cause packet drops and worsen performance.

Trap 3: Disable all security profiles to free resources.

Disabling security profiles bypasses security and may not be necessary.

Study all Troubleshooting and Diagnostics common traps →

A
Increase the session TTL to reduce session setup overhead.
Why wrong: Changing session TTL does not address root cause and may exhaust resources.
B
Check the CPU and memory utilization on the FortiGate.
High resource usage can cause slowdowns; checking this is a standard diagnostic step.
C
Verify the routing table for correct next-hop entries.
Incorrect routing can cause traffic to take suboptimal paths, leading to slowness.
D
Disable flow control on the WAN interface.
Why wrong: Disabling flow control can cause packet drops and worsen performance.
E
Disable all security profiles to free resources.
Why wrong: Disabling security profiles bypasses security and may not be necessary.

Full breakdown with real-world context →

Question 14hardmultiple choice

Read the full Troubleshooting and Diagnostics explanation →

Based on the exhibit, what can be concluded about the session?

Exhibit

Refer to the exhibit.

FGT # diagnose sys session list

session info: proto=6 proto_state=01 duration=826 expire=3579 timeout=3600 flags=00000000 socktype=0 sockport=0 av_idx=0 use=3
origin-shaper= 
reply-shaper= 
per_ip_shaper= 
class_id=0 ha_id=0 policy_dir=0 tunnel=/ vlan_cos=0/255
state=log may_dirty npu bcm npu_flag=01
statistic(bytes/packets/err): org=1234/10/0 reply=5678/20/0
orgs:10.1.1.10/1234->20.2.2.20/80 vlan=10
reply:20.2.2.20/80->10.1.1.10/1234 vlan=10

FGT #

Trap 1: The session is a one-way session with only outbound traffic.

The session shows both 'org' and 'reply' directions, indicating bidirectional traffic.

Trap 2: The session is not being logged.

The 'log' state flag indicates logging is enabled.

Trap 3: The session is in the 'npu' state, meaning it is being processed by…

The 'npu' flag means the session is offloaded to the NPU, not processed by CPU.

Study all Troubleshooting and Diagnostics common traps →

A
The session is a one-way session with only outbound traffic.
Why wrong: The session shows both 'org' and 'reply' directions, indicating bidirectional traffic.
B
The session is not being logged.
Why wrong: The 'log' state flag indicates logging is enabled.
C
The session is offloaded to the NPU for hardware acceleration.
The 'npu' flag indicates hardware offloading to the network processor.
D
The session is in the 'npu' state, meaning it is being processed by the CPU.
Why wrong: The 'npu' flag means the session is offloaded to the NPU, not processed by CPU.

Full breakdown with real-world context →

Question 15hardmultiple choice

Open the full BGP breakdown →

A company runs a FortiGate 600E in NAT/Route mode. They have a site-to-site VPN to a partner using route-based VPN with BGP. Recently, they added a new subnet 192.168.50.0/24 behind the FortiGate. The BGP session is up, and the route is being advertised to the partner. However, traffic from the partner to the new subnet fails. The FortiGate's routing table shows the route to 192.168.50.0/24 is present via the VPN interface. Firewall policies allow the traffic. A packet capture on the FortiGate's internal interface shows the partner's traffic arriving but no SYN-ACK being sent back. The FortiGate's session table shows sessions in 'SYN_RECV' state for the new subnet. What is the most likely cause?

Trap 1: The reverse path forwarding (RPF) check is dropping the incoming…

If RPF dropped the SYN, it would not appear in the session table as SYN_RECV.

Trap 2: The firewall policy is not configured with the correct source…

The policy allows traffic; otherwise the SYN would be dropped.

Trap 3: The BGP route advertisement is being filtered by a route map on the…

If BGP is up and advertising, filtering would prevent the route from being learned, but the partner is sending traffic.

Study all Troubleshooting and Diagnostics common traps →

A
The reverse path forwarding (RPF) check is dropping the incoming SYN.
Why wrong: If RPF dropped the SYN, it would not appear in the session table as SYN_RECV.
B
The firewall policy is not configured with the correct source interface.
Why wrong: The policy allows traffic; otherwise the SYN would be dropped.
C
The BGP route advertisement is being filtered by a route map on the partner side.
Why wrong: If BGP is up and advertising, filtering would prevent the route from being learned, but the partner is sending traffic.
D
The Phase 2 selector for the VPN does not include the new subnet, so the FortiGate does not encrypt the reply traffic.
The SYN is received but the return traffic cannot be encrypted because the Phase 2 selector does not match the new subnet, causing asymmetric routing.

Full breakdown with real-world context →

Question 16mediummulti select

Open the full VLAN trunking answer →

An administrator is troubleshooting a scenario where traffic from VLAN 100 to a server at 10.1.2.100 is being blocked. The FortiGate has an active security policy allowing the traffic and the routing table shows a correct route. Which TWO diagnostic commands should the administrator run to identify the cause of the blockage?

Trap 1: get system performance status

Shows overall system performance, not specific traffic blocking.

Trap 2: diagnose ip arp list

Shows ARP table, not relevant to policy blocking.

Trap 3: diagnose sys session list

Shows active sessions, but not helpful for blocked traffic that never creates a session.

Study all Troubleshooting and Diagnostics common traps →

A
diagnose sniffer packet any 'host 10.1.2.100' 4
Captures packets to verify traffic reaches the FortiGate.
B
get system performance status
Why wrong: Shows overall system performance, not specific traffic blocking.
C
diagnose ip arp list
Why wrong: Shows ARP table, not relevant to policy blocking.
D
diagnose sys session list
Why wrong: Shows active sessions, but not helpful for blocked traffic that never creates a session.
E
diagnose debug flow
Provides detailed flow trace showing policy matching and any blocks.

Full breakdown with real-world context →

Question 17hardmultiple choice

Read the full Troubleshooting and Diagnostics explanation →

A FortiGate is blocking HTTP traffic from 10.0.1.5 to 10.0.2.100, despite an explicit allow policy. The exhibit shows the configuration and debug flow output. What is the most likely cause?

Exhibit

Refer to the exhibit.

config firewall policy
    edit 1
        set name "Allow-Web"
        set srcintf "port1"
        set dstintf "port2"
        set srcaddr "10.0.1.0/24"
        set dstaddr "10.0.2.100"
        set action accept
        set schedule "always"
        set service "HTTP"
        set logtraffic all
    next
end

diag debug flow show function-name show-verbose

--- flow debug output ---
proton_state=0, reason=session-denied
id=20085 trace_id=155 func=print_pkt_detail line=4945 msg="vd-root:0 received a packet from port1: 10.0.1.5:45231 -> 10.0.2.100:80, proto 6."
id=20085 trace_id=155 func=resolve_ip_tuple line=4125 msg="Find an existing session, id 00001234, original direction"
id=20085 trace_id=155 func=__ip_session_match_tuple line=2818 msg="Session state: not ready"
id=20085 trace_id=155 func=__ip_session_find_by_session_id line=2773 msg="session session_deny because state proto is not ready"

Trap 1: The policy is applied to the wrong source interface.

The debug shows the packet received on port1, which matches the policy.

Trap 2: The policy action is set to deny.

Exhibit shows action accept.

Trap 3: The source address object does not include 10.0.1.5.

The srcaddr is 10.0.1.0/24 which includes 10.0.1.5.

Study all Troubleshooting and Diagnostics common traps →

A
The policy is applied to the wrong source interface.
Why wrong: The debug shows the packet received on port1, which matches the policy.
B
The policy action is set to deny.
Why wrong: Exhibit shows action accept.
C
TCP SYN flood protection is dropping the incomplete session.
The 'state proto not ready' indicates TCP handshake incomplete; often due to DoS protection thresholds.
D
The source address object does not include 10.0.1.5.
Why wrong: The srcaddr is 10.0.1.0/24 which includes 10.0.1.5.

Full breakdown with real-world context →

Question 18hardmultiple choice

Read the full VPN explanation →

A FortiGate is deployed as the edge firewall for a medium-sized enterprise. The network has three internal zones: Trust (10.10.0.0/16), DMZ (172.16.0.0/24), and Guest (192.168.0.0/24). The FortiGate has an IPSec VPN to a branch office (10.20.0.0/16). Users in the Trust zone report intermittent connectivity to a web server in the DMZ (172.16.0.10, TCP port 443). The FortiGate logs show occasional 'session denied' messages for traffic from Trust to DMZ with reason 'denied by forward policy check'. The security policy has an explicit allow rule for Trust to DMZ HTTPS. The administrator has verified routing is correct and there are no address overlaps. When the issue occurs, the administrator runs 'diag debug flow' and sees that the packet matches the correct policy but still gets denied. The debug output also shows 'forward policy check: denied'. What is the most likely cause and recommended action?

Trap 1: The route to the DMZ is intermittently flapping; add a static route…

Routing issues would show different debug messages, not 'forward policy check'.

Trap 2: The security profiles (AV, IPS) are blocking the traffic;…

Security profiles cause 'denied by application control' or 'denied by IPS', not 'forward policy check'.

Trap 3: The session helper for HTTPS is interfering; disable the HTTPS…

Session helpers do not cause 'forward policy check' denials.

Study all Troubleshooting and Diagnostics common traps →

A
A traffic shaping policy or application control profile is blocking the traffic; review and adjust the traffic shaping policy or application control profile applied to the policy.
Forward policy check denials are caused by traffic shaping or application control.
B
The route to the DMZ is intermittently flapping; add a static route with a higher distance.
Why wrong: Routing issues would show different debug messages, not 'forward policy check'.
C
The security profiles (AV, IPS) are blocking the traffic; temporarily disable all security profiles on the policy.
Why wrong: Security profiles cause 'denied by application control' or 'denied by IPS', not 'forward policy check'.
D
The session helper for HTTPS is interfering; disable the HTTPS session helper.
Why wrong: Session helpers do not cause 'forward policy check' denials.

Full breakdown with real-world context →

Question 19mediumdrag order

Read the full Troubleshooting and Diagnostics explanation →

Drag and drop the steps to perform a firmware upgrade on a FortiGate device into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 20mediummatching

Read the full Troubleshooting and Diagnostics explanation →

Match each high availability (HA) mode to its characteristic.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

One unit handles traffic; standby takes over on failure

Both units handle traffic simultaneously

FortiGate Clustering Protocol

Synchronizes sessions between HA members

Link used for HA communication and synchronization

Continue with 20-question session →

Free account

Track your progress over time

Create a free account to save your results and see which topics improve across sessions.

Focused Troubleshooting and Diagnostics sessions

Start a Troubleshooting and Diagnostics only practice session

Every question in these sessions is drawn from the Troubleshooting and Diagnostics domain — nothing else.

10 questions 20 questions 30 questions 50 questions

Browse all Troubleshooting and Diagnostics questions →Mixed NSE7 session

Frequently asked questions

What does the NSE7 exam test about Troubleshooting and Diagnostics?: Troubleshooting and Diagnostics questions test whether you can apply the concept in context, not just recognise a definition.
How should I use these practice questions?: Select your answer before revealing the explanation. Then read why each option is right or wrong — this active recall approach builds retention far faster than re-reading notes.
Can I practise just Troubleshooting and Diagnostics questions in a focused session?: Yes — the session launcher on this page draws every question from the Troubleshooting and Diagnostics domain. Use a 10-question session first to gauge your baseline, then move to 20 or 30 once the weak spots are clear.
Where can I practise other NSE7 topics?: Use the topic links above to move to related areas, or go back to the NSE7 question bank to see all topics.
Are these real exam questions or dumps?: These are original practice questions written to test the same concepts the NSE7 exam covers. They are not copied from any real exam or dump site.

Troubleshooting and Diagnostics only

10 questions 20 questions 30 questions 50 questions

Mixed NSE7 session

Track your progress

A free account saves results across sessions and highlights which topics need work.

Study resources

All NSE7 questions Troubleshooting and Diagnostics domain overview NSE7 exam guide

Exam traps to avoid

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Troubleshooting and Diagnostics practice questions

What to know about Troubleshooting and Diagnostics

Common Troubleshooting and Diagnostics exam traps

Troubleshooting and Diagnostics questions

A FortiGate administrator notices that traffic from a specific subnet is being dropped unexpectedly. The security policy allows the traffic, and there are no firewall policies blocking it. What is the most efficient first step to identify the cause of the drops?

An organization uses FortiGate with OSPF and BGP. Recently, routes from BGP are not being preferred over OSPF routes, causing suboptimal routing. The administrator wants to ensure BGP routes are preferred. Which two actions can achieve this? (Choose two.)

A FortiGate is experiencing high CPU usage. The administrator runs 'diagnose sys top' and sees that the process 'ipsengine' is using the most CPU. What is the most likely cause?

An administrator is troubleshooting a VPN tunnel that is not coming up. The remote peer is a third-party device. Which THREE actions should be taken to diagnose the issue?

A FortiGate administrator sees the following kernel log: 'kernel: [pid 1234] received packet with unknown or unsupported protocol 0x0800 on interface port1, drop'. What does this log indicate?

Based on the debug flow output, what is the reason the packet is dropped?

Exhibit

An administrator applies the above policy but users from 10.0.1.0/24 cannot access web servers at 10.0.2.0/24. However, they can ping the servers. What is the most likely cause?

Exhibit

A FortiGate is experiencing high latency on traffic passing through it. The administrator suspects that asymmetric routing is occurring. Which TWO symptoms are indicative of asymmetric routing?

A FortiGate cluster (A-P) has a session that is not synchronizing to the secondary unit. The administrator runs 'diagnose sys ha session-sync status' and sees that the session count is different between primary and secondary. Which is the most likely cause?

A customer reports intermittent connectivity issues between two internal subnets separated by a FortiGate firewall. The traffic is allowed by the policy, but users experience timeouts during peak hours. Which troubleshooting step should you take first?

An administrator is troubleshooting a scenario where IPSec VPN tunnels between two FortiGates are flapping. The logs show Phase 1 is up but Phase 2 fails with 'no proposal chosen'. The remote FortiGate has multiple Phase 2 selectors configured. What is the most likely cause?

A FortiGate is set up in a high availability (HA) cluster. The administrator notices that the primary unit is not synchronizing configuration changes to the secondary unit. The HA status shows 'synchronization failed'. What is the most likely cause?

Which TWO actions are appropriate when troubleshooting a slow network connection through a FortiGate?

Based on the exhibit, what can be concluded about the session?

Exhibit

A FortiGate is blocking HTTP traffic from 10.0.1.5 to 10.0.2.100, despite an explicit allow policy. The exhibit shows the configuration and debug flow output. What is the most likely cause?

Exhibit

Drag and drop the steps to perform a firmware upgrade on a FortiGate device into the correct order.

Match each high availability (HA) mode to its characteristic.

Track your progress over time

Start a Troubleshooting and Diagnostics only practice session

Related NSE7 topic practice pages

Advanced Networking and SD-WAN practice questions

Advanced VPN and Zero Trust practice questions

Enterprise Firewall and VDOMs practice questions

Advanced Threat Protection practice questions