How should I use these Scenario practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just Scenario questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Scenario domain.

NSE7 · topic practice

Scenario practice questions

Practise Fortinet NSE 7 Advanced Security NSE7 Scenario practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

11 questionsDomain: Scenario

Practice 10 questions Browse domain →

What the exam tests

What to know about Scenario

Scenario questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Scenario exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Scenario questions

11 questions · select your answer, then reveal the explanation

Question 1hardmultiple choice

Read the full VPN explanation →

An administrator is troubleshooting a scenario where IPSec VPN tunnels between two FortiGates are flapping. The logs show Phase 1 is up but Phase 2 fails with 'no proposal chosen'. The remote FortiGate has multiple Phase 2 selectors configured. What is the most likely cause?

Trap 1: Mismatched pre-shared keys.

Pre-shared key mismatch would cause Phase 1 to fail, not Phase 2.

Trap 2: Dead Peer Detection (DPD) settings are too aggressive.

DPD issues would cause the tunnel to drop after being established, not a Phase 2 failure.

Trap 3: Certificate validation failure.

Certificate issues would affect Phase 1 if certificate authentication is used, but logs show Phase 1 is up.

Study all Scenario common traps →

A
Mismatched Phase 2 proxy IDs (local/remote subnets).
The error 'no proposal chosen' is often due to mismatched proxy IDs in Phase 2.
B
Mismatched pre-shared keys.
Why wrong: Pre-shared key mismatch would cause Phase 1 to fail, not Phase 2.
C
Dead Peer Detection (DPD) settings are too aggressive.
Why wrong: DPD issues would cause the tunnel to drop after being established, not a Phase 2 failure.
D
Certificate validation failure.
Why wrong: Certificate issues would affect Phase 1 if certificate authentication is used, but logs show Phase 1 is up.

Full breakdown with real-world context →

Question 2mediummultiple choice

Read the full Scenario explanation →

An administrator is troubleshooting a scenario where FortiAnalyzer is not receiving logs from a FortiGate. The FortiGate shows 'log-fortianalyzer setting status: disconnected'. Which step should be taken first to resolve this?

Trap 1: Check the FortiGate's DNS resolution for the FortiAnalyzer hostname

DNS is only relevant if using hostname; the status shows disconnected, likely IP-based.

Trap 2: Restart the FortiGate's logging service

Restarting may not resolve underlying connectivity.

Trap 3: Disable and re-enable logging to FortiAnalyzer

Toggling may help but should be done after connectivity is confirmed.

Study all Scenario common traps →

A
Check the FortiGate's DNS resolution for the FortiAnalyzer hostname
Why wrong: DNS is only relevant if using hostname; the status shows disconnected, likely IP-based.
B
Verify that the FortiGate can reach the FortiAnalyzer IP address and that the FortiAnalyzer service is running
Connectivity is the most basic check; ping and service status should be verified first.
C
Restart the FortiGate's logging service
Why wrong: Restarting may not resolve underlying connectivity.
D
Disable and re-enable logging to FortiAnalyzer
Why wrong: Toggling may help but should be done after connectivity is confirmed.

Full breakdown with real-world context →

Question 3hardmultiple choice

Review the full routing breakdown →

A FortiGate administrator is troubleshooting a scenario where users in VDOM-1 cannot reach a server in VDOM-2. Inter-VDOM routing is configured using a VDOM link. The administrator checks the session table and sees that packets are arriving on the VDOM link interface but are not being forwarded. What is the MOST likely cause?

Trap 1: The VDOM link is in the wrong VDOM

If the VDOM link is created, it exists in both VDOMs; misplacement would prevent any traffic from reaching the link.

Trap 2: The routing table in VDOM-1 does not have a default route

The route to the server's subnet should be via the VDOM link, but if packets arrive at the link, routing is likely correct.

Trap 3: The VDOM link is not administratively up

If the link is down, packets would not arrive at the interface. The symptom is packets arriving but not forwarded.

Study all Scenario common traps →

A
The VDOM link is in the wrong VDOM
Why wrong: If the VDOM link is created, it exists in both VDOMs; misplacement would prevent any traffic from reaching the link.
B
A firewall policy is blocking the traffic from the VDOM link to the destination
Traffic entering a VDOM must match a policy. If no policy permits the traffic, it is dropped. The session table would show the packet arriving but no forward decision.
C
The routing table in VDOM-1 does not have a default route
Why wrong: The route to the server's subnet should be via the VDOM link, but if packets arrive at the link, routing is likely correct.
D
The VDOM link is not administratively up
Why wrong: If the link is down, packets would not arrive at the interface. The symptom is packets arriving but not forwarded.

Full breakdown with real-world context →

Question 4mediummulti select

Read the full Scenario explanation →

A network administrator is troubleshooting a split-brain scenario in an HA cluster. Which TWO conditions can cause split-brain? (Choose two.)

Trap 1: One unit has a higher priority

Higher priority determines primary, does not cause split-brain.

Trap 2: Firmware version mismatch

Firmware mismatch is not supported but may cause issues, not necessarily split-brain.

Trap 3: Session pickup is disabled

Session pickup does not affect split-brain.

Study all Scenario common traps →

A
Loss of heartbeat link between HA members
Without heartbeat, each unit assumes the other is down and becomes primary.
B
One unit has a higher priority
Why wrong: Higher priority determines primary, does not cause split-brain.
C
Firmware version mismatch
Why wrong: Firmware mismatch is not supported but may cause issues, not necessarily split-brain.
D
Mismatched HA configuration (e.g., different HA mode)
Mismatched config can prevent proper negotiation.
E
Session pickup is disabled
Why wrong: Session pickup does not affect split-brain.

Full breakdown with real-world context →

Question 5hardmultiple choice

Read the full Scenario explanation →

An administrator is troubleshooting an HA cluster (active-passive) where both units show 'primary' in 'get system ha status'. The cluster is not synchronizing configurations. What is the MOST likely cause?

Trap 1: The HA password is incorrect

Incorrect password prevents authentication but would not cause both to become primary.

Trap 2: The HA group ID is mismatched

Mismatched group ID prevents cluster formation but typically results in both units being standalone, not both primary.

Trap 3: The HA priority values are equal for both units

Equal priority does not cause both to be primary; tie-breaking uses device priority and serial number.

Study all Scenario common traps →

A
The HA password is incorrect
Why wrong: Incorrect password prevents authentication but would not cause both to become primary.
B
The HA heartbeat interface is disconnected or misconfigured
If heartbeat communication fails, each unit assumes the other is down and transitions to primary, causing a split-brain.
C
The HA group ID is mismatched
Why wrong: Mismatched group ID prevents cluster formation but typically results in both units being standalone, not both primary.
D
The HA priority values are equal for both units
Why wrong: Equal priority does not cause both to be primary; tie-breaking uses device priority and serial number.

Full breakdown with real-world context →

Question 6hardmultiple choice

Read the full Scenario explanation →

A FortiGate in an HA cluster shows the message 'split-brain detected' in the event log. The administrator checks the HA status and sees both units are in 'standalone' mode. What is the MOST likely cause of this split-brain scenario?

Trap 1: The HA priority is set to the same value on both units

Same priority can cause election issues but not typically split-brain; one will still become primary.

Trap 2: The HA mode is set to 'active-active' instead of 'active-passive'

Active-active mode does not cause split-brain; both units are active but with session load balancing.

Trap 3: The HA cluster is using a unicast heartbeat and the configuration…

Incorrect unicast configuration can prevent heartbeat, leading to split-brain, but the primary cause is loss of heartbeat.

Study all Scenario common traps →

A
The heartbeat interface is down on both units, causing them to assume they are the primary
When heartbeat communication is lost, both units may assume primary role, leading to split-brain.
B
The HA priority is set to the same value on both units
Why wrong: Same priority can cause election issues but not typically split-brain; one will still become primary.
C
The HA mode is set to 'active-active' instead of 'active-passive'
Why wrong: Active-active mode does not cause split-brain; both units are active but with session load balancing.
D
The HA cluster is using a unicast heartbeat and the configuration is incorrect
Why wrong: Incorrect unicast configuration can prevent heartbeat, leading to split-brain, but the primary cause is loss of heartbeat.

Full breakdown with real-world context →

Question 7easymultiple choice

Read the full Scenario explanation →

An administrator is troubleshooting an HA cluster where both units show as primary after a link failure. What is the most likely cause of this split-brain scenario?

Trap 1: The priority values are set identically

Identical priority can cause election issues but not split-brain if heartbeat is working.

Trap 2: The HA uptime is mismatched between the two units

Uptime mismatch does not cause split-brain; it's a symptom of failed synchronization.

Trap 3: The session pickup feature is disabled

Session pickup affects failover behavior, not split-brain.

Study all Scenario common traps →

A
The HA heartbeat interface is down or misconfigured
If the heartbeat link fails, each unit assumes the other is dead and transitions to primary.
B
The priority values are set identically
Why wrong: Identical priority can cause election issues but not split-brain if heartbeat is working.
C
The HA uptime is mismatched between the two units
Why wrong: Uptime mismatch does not cause split-brain; it's a symptom of failed synchronization.
D
The session pickup feature is disabled
Why wrong: Session pickup affects failover behavior, not split-brain.

Full breakdown with real-world context →

Question 8mediummultiple choice

Read the full Scenario explanation →

Two FortiGates in an HA cluster are experiencing a split-brain scenario where both units become primary. The administrator checks the HA configuration and sees that the heartbeat interfaces are configured correctly but the link status is 'down' on both units. What could cause this?

Trap 1: The heartbeat interface has been administratively disabled

An admin disable would show 'administratively down', not 'link down'.

Trap 2: The HA group ID is different on each unit

Different group IDs would prevent HA formation, but link would still show up.

Trap 3: The HA priority values are the same on both units

Equal priority could cause election issues but not split-brain if heartbeat is working.

Study all Scenario common traps →

A
The heartbeat interface has been administratively disabled
Why wrong: An admin disable would show 'administratively down', not 'link down'.
B
The physical cable connecting the heartbeat interfaces is faulty
Correct. A faulty cable causes link down, leading to loss of heartbeat and split-brain.
C
The HA group ID is different on each unit
Why wrong: Different group IDs would prevent HA formation, but link would still show up.
D
The HA priority values are the same on both units
Why wrong: Equal priority could cause election issues but not split-brain if heartbeat is working.

Full breakdown with real-world context →

Question 9mediummulti select

Read the full Scenario explanation →

An administrator is troubleshooting a scenario where VoIP traffic is not being properly handled by the FortiGate. The SIP ALG is enabled. Which THREE commands should the administrator run to diagnose the SIP traffic flow?

Trap 1: get router info routing-table all

Routing table is not specific to SIP ALG troubleshooting.

Trap 2: diagnose debug application sip -1

Duplicate of B; not needed again.

Study all Scenario common traps →

A
get router info routing-table all
Why wrong: Routing table is not specific to SIP ALG troubleshooting.
B
diagnose sys session filter dport 5060
SIP typically uses UDP 5060; filtering sessions on this port helps see if SIP sessions are being created.
C
diagnose debug application sip -1
This enables SIP ALG debugging at maximum verbosity, showing how the FortiGate processes SIP messages.
D
diagnose debug application sip -1
Why wrong: Duplicate of B; not needed again.

Full breakdown with real-world context →

Question 10hardmultiple choice

Study the full SD-WAN breakdown →

An administrator is troubleshooting an SD-WAN scenario where traffic from a branch office to a critical SaaS application is experiencing high latency. The SD-WAN rule uses the best quality SLA strategy. The administrator runs 'diagnose sys sdwan neighbor' and sees that both WAN links have SLA compliance above 90%. However, traffic still uses the slower link. The administrator then runs 'diagnose sys sdwan health-check list' and notices that the health-check server IP is different from the SaaS application's server IP. What is the MOST likely reason the traffic is not using the best-performing link?

Trap 1: The SD-WAN rule is configured with 'set load-balance-mode' instead…

The question states best quality strategy is used, so this is not the issue.

Trap 2: The health-check server is not reachable from the faster link

SLA compliance is above 90% on both links, so both are reachable.

Trap 3: The SD-WAN rule has a manual routing override configured

There is no mention of a manual override; the rule uses best quality strategy.

Study all Scenario common traps →

A
The health-check server's IP does not match the application's destination IP, so SLA measurements are not representative
SLA probes measure performance to the configured server, which may not correlate with actual performance to a different destination. The administrator should configure a health-check server that represents the real application traffic.
B
The SD-WAN rule is configured with 'set load-balance-mode' instead of 'best-quality'
Why wrong: The question states best quality strategy is used, so this is not the issue.
C
The health-check server is not reachable from the faster link
Why wrong: SLA compliance is above 90% on both links, so both are reachable.
D
The SD-WAN rule has a manual routing override configured
Why wrong: There is no mention of a manual override; the rule uses best quality strategy.

Full breakdown with real-world context →

Question 11mediummulti select

Read the full VPN explanation →

A network administrator is troubleshooting a scenario where remote users can connect via FortiClient VPN but cannot access internal resources. The FortiGate has a valid IPsec VPN configuration. Which THREE checks should the administrator perform to resolve the issue?

Trap 1: Increase the MTU on the VPN interface

MTU issues cause fragmentation but not complete lack of connectivity.

Trap 2: Disable DPD on the VPN phase 1

DPD is for dead peer detection, not access.

Study all Scenario common traps →

A
Check if there is a route on the internal network pointing back to the VPN subnet
Without a return route, responses can't reach the VPN clients.
B
Ensure that NAT is disabled on the VPN policy
NAT on VPN traffic can break connectivity to internal resources.
C
Increase the MTU on the VPN interface
Why wrong: MTU issues cause fragmentation but not complete lack of connectivity.
D
Disable DPD on the VPN phase 1
Why wrong: DPD is for dead peer detection, not access.
E
Verify that the firewall policy allows traffic from the VPN IP pool to the internal network
If no policy, traffic is dropped.

Full breakdown with real-world context →

Continue with 20-question session →

Free account

Track your progress over time

Create a free account to save your results and see which topics improve across sessions.

Focused Scenario sessions

Start a Scenario only practice session

Every question in these sessions is drawn from the Scenario domain — nothing else.

10 questions 20 questions 30 questions 50 questions

Browse all Scenario questions →Mixed NSE7 session

Frequently asked questions

What does the NSE7 exam test about Scenario?: Scenario questions test whether you can apply the concept in context, not just recognise a definition.
How should I use these practice questions?: Select your answer before revealing the explanation. Then read why each option is right or wrong — this active recall approach builds retention far faster than re-reading notes.
Can I practise just Scenario questions in a focused session?: Yes — the session launcher on this page draws every question from the Scenario domain. Use a 10-question session first to gauge your baseline, then move to 20 or 30 once the weak spots are clear.
Where can I practise other NSE7 topics?: Use the topic links above to move to related areas, or go back to the NSE7 question bank to see all topics.
Are these real exam questions or dumps?: These are original practice questions written to test the same concepts the NSE7 exam covers. They are not copied from any real exam or dump site.

Scenario only

10 questions 20 questions 30 questions 50 questions

Mixed NSE7 session

Track your progress

A free account saves results across sessions and highlights which topics need work.

Study resources

All NSE7 questions Scenario domain overview NSE7 exam guide

Exam traps to avoid

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Scenario practice questions

What to know about Scenario

Common Scenario exam traps

Scenario questions

An administrator is troubleshooting a scenario where IPSec VPN tunnels between two FortiGates are flapping. The logs show Phase 1 is up but Phase 2 fails with 'no proposal chosen'. The remote FortiGate has multiple Phase 2 selectors configured. What is the most likely cause?

An administrator is troubleshooting a scenario where FortiAnalyzer is not receiving logs from a FortiGate. The FortiGate shows 'log-fortianalyzer setting status: disconnected'. Which step should be taken first to resolve this?

A network administrator is troubleshooting a split-brain scenario in an HA cluster. Which TWO conditions can cause split-brain? (Choose two.)

An administrator is troubleshooting an HA cluster (active-passive) where both units show 'primary' in 'get system ha status'. The cluster is not synchronizing configurations. What is the MOST likely cause?

A FortiGate in an HA cluster shows the message 'split-brain detected' in the event log. The administrator checks the HA status and sees both units are in 'standalone' mode. What is the MOST likely cause of this split-brain scenario?

An administrator is troubleshooting an HA cluster where both units show as primary after a link failure. What is the most likely cause of this split-brain scenario?

Two FortiGates in an HA cluster are experiencing a split-brain scenario where both units become primary. The administrator checks the HA configuration and sees that the heartbeat interfaces are configured correctly but the link status is 'down' on both units. What could cause this?

An administrator is troubleshooting a scenario where VoIP traffic is not being properly handled by the FortiGate. The SIP ALG is enabled. Which THREE commands should the administrator run to diagnose the SIP traffic flow?

A network administrator is troubleshooting a scenario where remote users can connect via FortiClient VPN but cannot access internal resources. The FortiGate has a valid IPsec VPN configuration. Which THREE checks should the administrator perform to resolve the issue?

Track your progress over time

Start a Scenario only practice session

Related NSE7 topic practice pages

Advanced Networking and SD-WAN practice questions

Advanced VPN and Zero Trust practice questions

Enterprise Firewall and VDOMs practice questions

Advanced Threat Protection practice questions

Troubleshooting and Diagnostics practice questions

NSE7 fundamentals practice questions

NSE7 scenario practice questions

NSE7 troubleshooting practice questions

Frequently asked questions

Track your progress

Study resources

Exam traps to avoid