75 of 151 questions · Page 1/3 · Troubleshooting topic · Answers revealed
Shows phase 2 proposals and selectors.
Why this answer
Options A and D are correct. 'diagnose vpn ike config' shows the IKE configuration including phase 2 proposals and selectors. 'diagnose debug application ike 255' enables detailed IKE debug, which will show the negotiation details including phase 2 failure reasons.
A FortiGate is configured to send logs to FortiAnalyzer. The administrator notices that logs are not appearing on FortiAnalyzer. Running 'diagnose log device show' shows 'connected=no'. What is the most likely cause?
Connectivity failure is the primary reason for 'connected=no'.
Why this answer
Option B is correct. 'connected=no' indicates that the FortiGate is not successfully establishing a connection to the FortiAnalyzer. This is commonly due to network connectivity issues between the two devices or incorrect IP/port configuration.
A FortiGate is experiencing high latency on traffic passing through it. The administrator suspects that asymmetric routing is occurring. Which TWO symptoms are indicative of asymmetric routing?
This indicates that the return traffic may be arriving on a different interface than expected.
Why this answer
Asymmetric routing occurs when traffic from the same source IP takes different paths through the network, causing packets to arrive on different FortiGate interfaces for different sessions. This breaks stateful inspection because the firewall expects all packets of a session to traverse the same interface; when they don't, it can lead to session timeouts or dropped packets, manifesting as high latency.
Exam trap
The trap here is that candidates often confuse asymmetric routing with general routing issues like ECMP (option A) or performance problems (option D), but the exam specifically tests the stateful firewall behavior where traffic arriving on different interfaces for the same session is the definitive symptom.
A FortiGate in an HA cluster shows the message 'split-brain detected' in the event log. The administrator checks the HA status and sees both units are in 'standalone' mode. What is the MOST likely cause of this split-brain scenario?
When heartbeat communication is lost, both units may assume primary role, leading to split-brain.
Why this answer
Option A is correct. Loss of heartbeat communication is the typical cause of split-brain.
A FortiGate is experiencing high CPU usage due to a large number of sessions. Which TWO actions can the admin take to mitigate the issue? (Choose two.)
Shorter TTL removes idle sessions quicker, reducing table size and CPU overhead.
Why this answer
Rate limiting sessions and increasing session TTL can reduce CPU load by controlling session creation and expiration. Option A and D are correct.
An administrator is troubleshooting an SD-WAN scenario where traffic from a branch office to a critical SaaS application is experiencing high latency. The SD-WAN rule uses the best quality SLA strategy. The administrator runs 'diagnose sys sdwan neighbor' and sees that both WAN links have SLA compliance above 90%. However, traffic still uses the slower link. The administrator then runs 'diagnose sys sdwan health-check list' and notices that the health-check server IP is different from the SaaS application's server IP. What is the MOST likely reason the traffic is not using the best-performing link?
SLA probes measure performance to the configured server, which may not correlate with actual performance to a different destination. The administrator should configure a health-check server that represents the real application traffic.
Why this answer
SD-WAN SLA health checks measure performance to a specific server (e.g., a public DNS or internet IP). If the actual application traffic goes to a different server, the measured SLA may not reflect the real path performance to that destination. The route selection logic uses SLA results only for the configured health-check server.
An administrator is testing failover in an HA cluster. They unplug the primary FortiGate's port1 (the heartbeat interface) but the secondary does not take over. The heartbeat is configured on port1. What is the MOST likely cause?
If heartbeat is configured on multiple interfaces, the secondary may still receive heartbeat from the primary via another interface, preventing failover.
Why this answer
Option C is correct. In HA, failover is triggered by loss of heartbeat plus loss of monitored ports or a dead gateway. Simply unplugging the heartbeat interface may cause split-brain, not failover, because the primary is still operational and the secondary still sees the primary's heartbeat? Actually, unplugging the heartbeat interface on the primary means the secondary loses heartbeat.
But if the primary still has other monitored ports up, it will remain primary. However, the secondary should detect loss of heartbeat and become primary after a timeout. But if the primary still has heartbeat on another path? The question says heartbeat is configured on port1 and that port was unplugged.
The likely cause is that the primary still has another heartbeat interface or the failover threshold is not met. Option C is the most plausible.
A network administrator runs 'get system ha status' on a FortiGate HA cluster and sees that only one unit shows as primary. The secondary unit shows as 'standalone' with no HA peer detected. What is the MOST likely cause of this issue?
If the heartbeat link fails, the secondary cannot communicate with the primary and will assume it is standalone, resulting in the observed status.
Why this answer
When the HA heartbeat link is down, the secondary unit cannot detect the primary and will operate as standalone. The serial number mismatch or priority settings would cause different behavior (e.g., split-brain or both primary).
A FortiGate admin runs 'diagnose debug application authd -1' but sees no output for LDAP authentication attempts. What is the MOST likely reason?
To see authd debug, you need to enable debug flow or set debug level.
Why this answer
Option B is correct because without enabling debug flow or setting debug level, authd may not output debug messages. Option A is not specific to authd. Option C would cause connection errors, not silent.
Option D is unlikely.
An administrator configures BGP route advertisement but the routes are not being sent to the neighbor. The BGP session is established. What is the MOST likely cause?
Without a network statement, FortiGate does not advertise the route even if it is in the routing table.
Why this answer
For routes to be advertised, they must be present in the BGP table, which requires either redistribution from another protocol or manual network statements. The most common causes are missing 'network' statements or redistribution configuration.
An administrator is troubleshooting BGP and runs 'get router info bgp neighbors 10.0.0.1' and sees 'BGP state = Active'. The neighbor IP is reachable via ping. What is the most likely cause?
A mismatch in remote AS will cause the neighbor to reject the connection, leading to Active state.
A FortiGate is deployed as the edge firewall for a medium-sized enterprise. The network has three internal zones: Trust (10.10.0.0/16), DMZ (172.16.0.0/24), and Guest (192.168.0.0/24). The FortiGate has an IPSec VPN to a branch office (10.20.0.0/16). Users in the Trust zone report intermittent connectivity to a web server in the DMZ (172.16.0.10, TCP port 443). The FortiGate logs show occasional 'session denied' messages for traffic from Trust to DMZ with reason 'denied by forward policy check'. The security policy has an explicit allow rule for Trust to DMZ HTTPS. The administrator has verified routing is correct and there are no address overlaps. When the issue occurs, the administrator runs 'diag debug flow' and sees that the packet matches the correct policy but still gets denied. The debug output also shows 'forward policy check: denied'. What is the most likely cause and recommended action?
Forward policy check denials are caused by traffic shaping or application control.
Why this answer
The debug flow output shows the packet matches the correct security policy but is still denied by 'forward policy check'. This indicates that a secondary policy component, such as a traffic shaping policy or application control profile, is blocking the traffic. These features can override the security policy action if they are configured to deny or drop matching traffic, even when the security policy itself is set to allow.
Exam trap
The trap here is that candidates often assume a security policy 'allow' rule is sufficient, overlooking that FortiGate's forward policy check evaluates additional policy layers (like traffic shaping or application control) that can independently deny traffic even after a security policy match.
How to eliminate wrong answers
Option B is wrong because route flapping would cause 'no route to host' errors, not 'denied by forward policy check' in the debug flow; the administrator has already verified routing is correct. Option C is wrong because security profiles (AV, IPS) would show specific block messages in the logs (e.g., 'IPS: blocked') and the debug flow would indicate the profile action, not a generic 'forward policy check' denial. Option D is wrong because the HTTPS session helper is used for non-standard ports or explicit proxy scenarios and does not cause 'forward policy check' denials; disabling it would not resolve a policy-based block.
An administrator needs to monitor the FortiGate's CPU usage in real-time from the CLI. Which command should be used?
This is the correct command for real-time CPU monitoring.
Why this answer
The command 'diagnose sys top' displays real-time CPU and memory usage for FortiGate processes, similar to 'top' on Linux. It's the standard CLI tool for performance monitoring.
A FortiGate administrator notices that traffic from a specific subnet is being dropped unexpectedly. The security policy allows the traffic, and there are no firewall policies blocking it. What is the most efficient first step to identify the cause of the drops?
Packet sniffer with filter can capture the actual packets and show the drop reason in the output.
Why this answer
The 'diag sniffer packet any "host 10.0.1.0/24" 4' command captures packets at the kernel level before firewall processing, allowing you to see if traffic is reaching the FortiGate and where it is being dropped (e.g., due to reverse-path forwarding, session helper, or DoS policies). This is the most efficient first step because it provides immediate, low-level visibility into packet drops without requiring configuration changes or waiting for logs.
Exam trap
The trap here is that candidates often jump to 'diagnose debug flow' as the default troubleshooting tool, but it only works after a session is created, missing pre-session drops that the sniffer can immediately expose.
How to eliminate wrong answers
Option B is wrong because 'diagnose debug flow' is a session-level debug that requires traffic to first match a session; if traffic is dropped before session creation (e.g., by ASIC, DoS policy, or RPF check), the debug flow may show no output or misleading 'no matching policy' messages, wasting time. Option C is wrong because enabling 'deny-log' on all policies only logs drops caused by explicit firewall policies, but the question states no policies are blocking the traffic, so this would not capture the actual drop cause (e.g., session helper, DoS, or routing issues). Option D is wrong because enabling global traffic logging requires a configuration change and waiting for traffic to pass, which is inefficient; logs may also not show the specific drop reason (e.g., kernel-level drops are not always logged).
Two FortiGates in an HA cluster are experiencing a split-brain scenario where both units become primary. The administrator checks the HA configuration and sees that the heartbeat interfaces are configured correctly but the link status is 'down' on both units. What could cause this?
Correct. A faulty cable causes link down, leading to loss of heartbeat and split-brain.
Why this answer
A split-brain occurs when heartbeat communication is lost. If the heartbeat interfaces show link down, it indicates a physical or layer-1 issue, such as a faulty cable or switch port.
An administrator needs to verify if a FortiGate is receiving BGP routes from a peer. Which command should the admin run to see the BGP routing table?
This command shows the BGP routing table entries.
Why this answer
'get router info bgp table' displays the BGP routing table, showing learned and advertised routes.
An administrator needs to check the health of an SD-WAN link by viewing the last SLA probe results. Which command should be used?
This command shows the results of SD-WAN health checks including SLA status.
Why this answer
Option A is correct. 'diagnose sys virtual-wan-link health-check' displays current health check status.
A FortiGate administrator is investigating a slow network performance issue. The administrator suspects that session table limits are being reached. Which TWO metrics should be monitored to confirm this? (Choose two.)
A high session fail rate may indicate that new session creation is being denied due to table limits.
Why this answer
Options A and D are correct. Current session count shows how many sessions exist, and session fail rate indicates if new sessions are being dropped.
If one side has PFS enabled and the other does not, or they use different DH groups, phase 2 will fail.
Why this answer
Even if phase 1 succeeds, phase 2 can fail due to mismatched proxy IDs (local/remote subnets) or mismatched PFS settings. Authentication method and encryption algorithm are phase 1 parameters.
In an HA cluster, after a failover, some established sessions are not being synchronized to the new primary unit. Which setting must be enabled to ensure session synchronization?
This enables session synchronization in HA.
Why this answer
Option B is correct because 'set session-pickup enable' under config system ha enables session synchronization between HA members. Option A controls failover order. Option C is for priority.
Option D is not a valid setting.
CPU usage is a critical performance indicator.
Phase 2 requires matching proxy IDs to establish SAs.
Why this answer
Options B and D are correct. Phase 2 proposal mismatch is usually due to incompatible encryption/authentication algorithms (B) or mismatched proxy IDs (local/remote subnets) (D). Options A and C would not cause a proposal mismatch.
A network administrator is troubleshooting a split-brain scenario in an HA cluster. Which TWO conditions can cause split-brain? (Choose two.)
Without heartbeat, each unit assumes the other is down and becomes primary.
Why this answer
Options A and D are correct. Loss of HA heartbeat communication (A) causes both units to think they are primary. Mismatched HA configuration (D) can also cause split-brain.
Option B causes failover but not split-brain. Option C is irrelevant.
Part of phase 2 proposal.
Why this answer
Phase 2 uses different proposals than phase 1. The correct proposals are encryption algorithm (ESP), authentication algorithm, and perfect forward secrecy (PFS). Option A and B are correct because they are part of the phase 2 proposal.
A FortiGate administrator is troubleshooting a VPN tunnel that connects to a remote site. The tunnel is up, but traffic is not passing. The administrator checks the Phase 2 settings and sees that the local and remote subnets are correctly defined. What is the next step to diagnose the issue?
Even if the tunnel is up, traffic must be allowed by a firewall policy from the VPN interface to the destination zone.
A network administrator is troubleshooting an IPsec VPN tunnel that fails to establish. The remote gateway logs show a proposal mismatch. On FortiGate, the administrator runs 'diagnose vpn ike config' and sees 'proposal: aes128-sha1, aes256-sha256'. The remote side expects 'aes256-sha1'. What is the most likely cause?
Correct. The local proposal list must contain at least one matching algorithm set that the remote gateway supports.
Why this answer
The proposal mismatch occurs because the FortiGate's IKE proposal includes aes256-sha256 but not aes256-sha1, and the remote gateway expects aes256-sha1. The correct action is to add aes256-sha1 to the proposal list.
An administrator wants to monitor the session count on a FortiGate in real time. Which CLI command provides this information?
This command displays current session statistics including total session count.
Why this answer
Option A is correct. 'diagnose sys session stat' shows session statistics.
An administrator applies the above policy but users from 10.0.1.0/24 cannot access web servers at 10.0.2.0/24. However, they can ping the servers. What is the most likely cause?
The service 'HTTP' only covers port 80; if the web server uses HTTPS (port 443), the policy won't match.
Why this answer
The policy allows HTTP traffic (port 80), but the web servers are likely using HTTPS (port 443). Since the service object 'HTTP' in FortiGate typically only includes TCP/80, HTTPS traffic is denied by default. The administrator can ping the servers because ICMP is permitted by an implicit or explicit policy, confirming that routing and connectivity are functional.
Exam trap
The trap here is that candidates assume 'HTTP' covers all web traffic, but FortiGate strictly matches the defined ports in the service object, so HTTPS (port 443) is blocked unless explicitly permitted.
How to eliminate wrong answers
Option B is wrong because the destination address 10.0.2.0/24 is correct for the web servers, and ping success confirms reachability. Option C is wrong because the schedule 'always' is a default, always-active schedule that cannot be misconfigured; if it were invalid, no traffic would pass. Option D is wrong because the source interface is correctly set to the interface connected to 10.0.1.0/24, as evidenced by successful ping traffic from that subnet.
An administrator is investigating a security incident and needs to view raw logs from a FortiAnalyzer for a specific time range. The administrator wants to ensure the logs are not aggregated or summarized. Which type of log view should be used?
Log View displays raw, unaggregated logs from the FortiAnalyzer, ideal for detailed incident investigation.
Why this answer
Option C is correct. Log View provides access to raw logs without aggregation.
An administrator is troubleshooting an HA cluster (active-passive) where both units show 'primary' in 'get system ha status'. The cluster is not synchronizing configurations. What is the MOST likely cause?
If heartbeat communication fails, each unit assumes the other is down and transitions to primary, causing a split-brain.
Why this answer
When both units claim to be primary, it indicates a split-brain scenario. This is typically caused by HA heartbeat failure, often due to a faulty or disconnected HA heartbeat interface.
A FortiGate administrator is troubleshooting a BGP session that fails to establish with a neighbor at 10.0.1.1. Running 'diagnose ip router bgp all' shows the neighbor state as 'Idle'. Which TWO commands should the administrator run NEXT to diagnose the issue?
This displays the complete BGP configuration, including neighbor IP, remote AS, and update-source, helping identify misconfiguration.
Mismatched encryption algorithms cause phase1 failure.
Why this answer
Phase 1 negotiation fails when proposals do not match. Common causes include encryption algorithm, hash, DH group, or lifetime mismatch. Option A is correct because the encryption algorithm is a key part of the proposal.
Which FortiGate command is used to view the current CPU usage of individual processes in real time?
This shows real-time per-process CPU and memory usage.
Why this answer
Option C is correct. 'diagnose sys top' displays a top-like process list with CPU and memory usage.
A FortiGate administrator needs to identify which process is consuming the most memory. Which command should be used?
This command displays processes and memory usage; pressing 'm' sorts by memory.
Why this answer
The 'diagnose sys top' command shows processes sorted by CPU usage by default; pressing 'm' changes sort to memory usage.
An administrator is troubleshooting a BGP session that is not establishing between two FortiGates. The administrator has verified that the neighbor IP is reachable. Which TWO commands should be used to further diagnose the issue? (Choose two.)
This command shows BGP session state and counters, useful for troubleshooting.
Why this answer
Options A and B are correct. 'get router info bgp neighbor' shows session state, and 'diagnose ip router bgp all enable' provides debug output for negotiation.
An administrator is configuring SD-WAN with multiple members. When a rule matches, traffic is not being load-balanced as expected. Which command should the admin use to verify the SD-WAN rule selection for a specific flow?
This command displays SD-WAN rules, members, and their status, aiding in rule selection verification.
Why this answer
The command 'diagnose sys sdwan info' shows SD-WAN configuration and rule mapping, helping verify which rule is applied.
You are troubleshooting a BGP session between FortiGate and an ISP router. The FortiGate shows BGP state 'Active' and the debug output shows 'No route to peer'. The ISP router's loopback IP is 203.0.113.1, and the next-hop interface is port1 (10.0.0.1/30). The FortiGate has a static route to 203.0.113.1 via port1. What is the MOST likely cause?
If port1 is down, the static route is removed from the routing table, causing 'No route to peer'.
Why this answer
The 'No route to peer' message indicates FortiGate cannot find a route to the peer IP. Even though a static route exists, if the route's outgoing interface is down, it's not in the routing table. Option C is correct because a down interface invalidates the static route.
An administrator notices that after upgrading FortiOS, some traffic that was previously inspected by the antivirus profile is now bypassing scanning. The administrator suspects the session helper configuration may be interfering. Which TWO session helper protocols are known to potentially affect traffic inspection if improperly configured?
FTP helper manages data channels; improper configuration can lead to inspection gaps.
A BGP route from an ISP is not appearing in the FortiGate's routing table. The BGP session is established and 'show ip bgp' shows the route as valid but not best. Which command should the admin use to investigate why the route is not selected as best?
This command shows BGP route details and best path selection reasons.
Why this answer
The 'diagnose ip router bgp routes' command provides detailed BGP route information, including the reason why a route is not best (e.g., weight, local preference, AS path, MED). Option A is correct.
An administrator configures an ALG for SIP traffic but notices that some SIP calls are failing. The admin suspects the ALG is modifying SIP headers incorrectly. Which debug command can help verify the ALG's actions on SIP packets?
This enables detailed SIP ALG debug output.
Why this answer
'diagnose debug application sip -1' enables SIP ALG debugging, showing how the ALG processes SIP messages.
An administrator is troubleshooting a scenario where VoIP traffic is not being properly handled by the FortiGate. The SIP ALG is enabled. Which THREE commands should the administrator run to diagnose the SIP traffic flow?
SIP typically uses UDP 5060; filtering sessions on this port helps see if SIP sessions are being created.
Why this answer
To diagnose SIP ALG issues, the administrator should check SIP-specific debug, session table for UDP 5060, and application control logs. Viewing general traffic logs is less specific, and checking the routing table is not directly relevant to ALG processing.
Which of the following is a valid command to check the status of all BGP neighbors on a FortiGate?
This is the correct command to display BGP neighbor status.
Why this answer
Option D is correct. 'get router info bgp summary' displays a summary of all BGP neighbors and their states.
Without the session helper enabled, FortiGate will not inspect FTP control traffic and will not open pinholes for data connections.
Why this answer
Active FTP requires the server to initiate a data connection back to the client. The session helper should dynamically create pinholes for these connections. If the session helper is not enabled for the policy, the data connection will be blocked.
You are troubleshooting a VPN phase 2 negotiation failure. The logs show 'no proposal chosen'. What is the MOST likely cause?
Mismatched algorithms cause 'no proposal chosen'.
Why this answer
Option C is correct because 'no proposal chosen' indicates that the encryption/authentication algorithms proposed by the initiator do not match the responder's configured settings. Option A would cause phase 1 failure. Option B would cause phase 1 failure.
Option D is not a direct cause.
During a failover test in an active-passive HA cluster, the administrator notices that the secondary unit does not take over the primary role after a link failure on the primary. The 'get system ha status' shows both units in 'standalone' mode. What is the MOST likely cause?
Heartbeat failure causes units to operate independently as standalone.
Why this answer
Option C is correct. If both units show standalone, the HA heartbeat is not functioning. The most common cause is that the HA heartbeat interface is not configured correctly or is down on one unit.
This shows the configured phase 2 parameters, helpful for mismatch detection.
Why this answer
Phase 2 uses IPsec SA negotiation, which is logged by IKE debug. Additionally, checking the phase 2 configuration can reveal mismatches. The correct commands are A and D.
A FortiGate administrator wants to see the current number of active sessions. Which command provides this information?
This command shows session count and other statistics.
Why this answer
The 'diagnose sys session stat' command displays session statistics, including the total number of sessions.
Phase 2 negotiation fails when proposals do not match.
Why this answer
Option A is correct. The 'no proposal chosen' error in phase 2 indicates a mismatch in the phase 2 parameters (encryption, authentication, PFS, etc.) between the two peers. The administrator should verify that the phase 2 selectors and proposals match on both ends.
An administrator wants to troubleshoot why specific traffic is not matching a configured firewall policy. Which debug command should be used?
This traces packet flow and shows policy matching.
Why this answer
Option D is correct because 'diagnose debug flow' shows packet flow and policy matching decisions. Option A shows current sessions. Option B shows interfaces.
Option C shows firewall statistics.
An administrator runs 'diagnose debug application fnbam -1' and sees messages like 'LB_SELECT: selected server 10.0.0.2:80' but the client connection fails. The FortiGate is configured with server load balancing. What could be the issue?
Correct. The debug shows selection, but the server may not be listening or reachable.
Why this answer
The debug shows the load balancer selected a server, but the connection fails. This indicates the server is not responding or the health check is failing. The administrator should check the server's health and ensure the real server is up.
A FortiGate is configured with multiple BGP peers. One of the peers is not receiving the expected routes. The administrator runs 'get router info bgp neighbors <IP>' and sees that the 'State/PfxRcd' field is 'Active'. What does this indicate?
Active state indicates the router is actively trying to initiate a TCP connection to the peer, but the session is not yet up.
An administrator notices high CPU usage on a FortiGate. To identify which process is consuming the most CPU, which command should be used?
This displays a list of processes sorted by CPU usage.
Why this answer
'diagnose sys top' provides a real-time view of process CPU usage, similar to Linux 'top', allowing identification of resource-intensive processes.
A FortiGate HA cluster is experiencing persistent split-brain even after both units are rebooted. Which THREE actions should the administrator take to resolve this issue? (Choose three.)
Ensures reliable heartbeat exchange.
Why this answer
Options A, B, and E are correct. Changing the HA mode to active-passive ensures no concurrent primaries. Increasing the failover threshold (hold time) can prevent flapping.
Verifying heartbeat interface connectivity ensures proper communication. Option C (disabling HA) is not a resolution; option D (reducing priority) does not fix split-brain root cause.
An administrator wants to see the current number of active sessions on a FortiGate. Which command should the admin use?
This command shows session count and other metrics.
Why this answer
'diagnose sys session stat' displays session statistics including total active sessions.
An administrator notices that an application-based SD-WAN rule is not steering traffic as expected. The SLA targets are configured correctly. Which TWO debug commands should the administrator use to diagnose the issue? (Choose two.)
Displays SD-WAN configuration, member status, and SLA compliance.
Why this answer
Options A and C are correct. 'diagnose sys sdwan info' shows SD-WAN configuration and SLA status. 'diagnose sys session list' with filters shows the session details including SD-WAN member selection. Option B is invalid, D shows overall status but not per-rule, E is unrelated.
Drag and drop the steps to perform a firmware upgrade on a FortiGate device into the correct order.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Why this order
Always back up config before upgrade, then upload, confirm, and verify.
An HA cluster of two FortiGates is experiencing split-brain. After investigation, you find that the heartbeat link is down on the primary unit. Which action will resolve the split-brain condition?
Split-brain is caused by heartbeat failure; restoring the link resolves it.
Why this answer
Split-brain occurs when heartbeat communication fails, and both units assume primary role. Restoring the heartbeat link (Option C) allows them to re-establish communication and elect a single primary.
An administrator configures a session helper for FTP on FortiGate. After enabling the helper, FTP clients can establish control connections but data transfers fail. What is the most likely cause?
If the helper is not associated with the policy or the traffic doesn't match, the helper won't open data ports.
Why this answer
Option C is correct. FTP uses separate control and data connections. The session helper dynamically opens pinholes for data connections.
If the ALG/session helper is not correctly inspecting the control channel, it may not open the required data ports, causing transfers to fail. However, the question implies the helper is enabled but not working. Often this is due to asymmetric routing or the helper not seeing both directions.
But the most common cause is that the FTP ALG is not inspecting the traffic because the policy does not match the helper's expected traffic. Option C is the best fit.
An SD-WAN rule is configured to steer traffic based on SLA metrics. The administrator notices that traffic is not using the expected member interface even though the SLA is meeting thresholds. What should the administrator check FIRST?
This command shows detailed SD-WAN information.
Why this answer
Option A is correct. The 'diagnose sys sdwan info' command provides real-time information about SD-WAN rules, member status, SLA performance, and route selection. It is the first step to troubleshoot why traffic is not following the expected path.
You execute 'diagnose sys session filter dport 443' and see output: 'proto=6 proto_state=01 duration=3600 expire=3599'. What does 'proto_state=01' indicate about this session?
State 01 = SYN_SENT; the initial SYN has been sent but no SYN-ACK received yet.
Why this answer
In FortiGate session output, proto_state=01 for TCP (proto=6) means the session is in the 'SYN_SENT' state, indicating the three-way handshake has not completed.
An administrator is troubleshooting an HA cluster where both units show as primary after a link failure. What is the most likely cause of this split-brain scenario?
If the heartbeat link fails, each unit assumes the other is dead and transitions to primary.
Why this answer
Split-brain occurs when HA heartbeat communication fails, causing both units to believe they are the primary. A broken heartbeat link is the typical cause.
An administrator configures SD-WAN with multiple members. The SD-WAN rule uses the 'latency' strategy. The administrator notices that traffic is not switching to the best-performing member even when latency exceeds the threshold. What could be the issue?
Without SLA, performance monitoring is not active, so latency strategy has no data to act on.
Why this answer
Option D is correct. SD-WAN rules require performance SLA targets to be configured and linked to the SD-WAN rule. Without an SLA, the latency strategy has no performance benchmark to trigger failover.
SSL inspection in proxy mode goes through the WAD daemon; checking WAD confirms inspection.
Why this answer
To verify SSL inspection, check policy configuration, use session filter to see if sessions are decrypted, and use debug flow to inspect the traffic path. Option A, B, and D are correct.
An administrator is troubleshooting a scenario where traffic from VLAN 100 to a server at 10.1.2.100 is being blocked. The FortiGate has an active security policy allowing the traffic and the routing table shows a correct route. Which TWO diagnostic commands should the administrator run to identify the cause of the blockage?
Captures packets to verify traffic reaches the FortiGate.
Why this answer
Option A is correct because 'diagnose sniffer packet any host 10.1.2.100 4' captures packets to/from the server at the interface level, allowing the administrator to see if traffic from VLAN 100 is actually arriving at the FortiGate and whether it is being dropped or forwarded. This command helps identify if the issue is at Layer 2 (e.g., VLAN misconfiguration) or Layer 3 (e.g., routing or firewall drops).
Exam trap
The trap here is that candidates often choose 'diagnose sys session list' thinking it shows blocked traffic, but it only lists established sessions, not dropped packets or failed session creation attempts.
An administrator needs to troubleshoot an HA synchronization issue. Which TWO commands provide information about the HA synchronization status?
Dumps detailed HA synchronization data.
Why this answer
The command 'get system ha status' shows the cluster status and synchronization state. The command 'diagnose ha dump' provides detailed synchronization information.
SSL VPN tunnel establishment requires UDP 4500 (for NAT traversal) or TCP 443 for initial handshake. If blocked, the client cannot respond, leading to the 'no response from client' message.
Why this answer
A network administrator runs the command 'diagnose debug application ssl -1' and sees the following output: 'ssl_generate_proxy_cert: cannot find CA certificate for issuer CN=www.example.com'. What is the MOST likely cause?
If the CA certificate used to sign proxy certificates is missing or invalid, FortiGate cannot generate a new certificate for the inspected site.
Why this answer
The error indicates that FortiGate cannot find the CA certificate used to generate a proxy certificate for the site. This happens when deep inspection is enabled but the CA certificate used for re-signing is missing or misconfigured.
A FortiGate administrator wants to check if the device is experiencing high CPU usage due to a specific process. Which command should they use to display real-time process CPU usage?
Shows real-time process list with CPU usage.
Why this answer
Option A is correct. 'diagnose sys top' shows real-time CPU and memory usage per process, similar to the Linux 'top' command. It helps identify which process is consuming CPU.
This enables IKE debug with level -1 for verbose output.
Why this answer
The command 'diagnose debug application ike -1' enables detailed IKE debugging, showing phase 1 and phase 2 negotiation steps.
Based on the exhibit, what can be concluded about the session?
The 'npu' flag indicates hardware offloading to the network processor.
Why this answer
The session state 'npu' indicates that the session has been offloaded to the Network Processor Unit (NPU) for hardware acceleration. This is a normal and expected state for traffic that matches hardware-offloadable profiles, allowing the NPU to process packets at wire speed without CPU intervention.
Exam trap
The trap here is that candidates often confuse the 'npu' state with CPU processing, assuming it means 'NPU processing by CPU' rather than recognizing it as hardware offload, leading them to select Option D incorrectly.
How to eliminate wrong answers
Option A is wrong because the session state 'npu' does not imply one-way or only outbound traffic; it simply indicates hardware offload, and sessions can be bidirectional. Option B is wrong because the session state 'npu' does not indicate whether logging is enabled or disabled; logging is configured separately via firewall policies or session log settings. Option D is wrong because the 'npu' state means the session is offloaded to the NPU for hardware acceleration, not that it is being processed by the CPU; CPU processing would be indicated by states like 'tcp' or 'udp' without offload.
An administrator is troubleshooting a split-brain situation in an HA cluster. They run 'get system ha status' and see that both FortiGates report themselves as primary. Which command should they run to force the secondary unit to take over as primary?
Resets the uptime, which can trigger a priority re-evaluation and failover.
Why this answer
Option D is correct. The 'diagnose sys ha reset-uptime' command resets the HA uptime on the unit, causing it to recalculate priority. If the other unit has a higher priority, this can force a failover.
Alternatively, 'execute ha failover' is not a valid command. The correct command to force a failover is 'execute ha failover set'? Actually, FortiGate does not have a direct failover command. The standard method is to reboot the primary or use 'diagnose sys ha reset-uptime'.
Option D is the most appropriate.
A FortiGate is set up in a high availability (HA) cluster. The administrator notices that the primary unit is not synchronizing configuration changes to the secondary unit. The HA status shows 'synchronization failed'. What is the most likely cause?
HA sync only occurs after the configuration is saved; unsaved changes are not synchronized.
Why this answer
Option D is correct because FortiGate HA requires the configuration to be saved (via 'execute backup config' or 'write memory') on the primary unit before it can be synchronized to the secondary unit. If the configuration is not saved, the primary unit does not have a committed configuration to push, leading to a 'synchronization failed' status even though the HA cluster is otherwise healthy.
Exam trap
The trap here is that candidates often assume HA synchronization issues are always caused by network or heartbeat problems, overlooking the fundamental requirement that the configuration must be saved before it can be synchronized.
How to eliminate wrong answers
Option A is wrong because FortiGate HA requires both units to run the same firmware version; if they differ, the cluster will not form at all or will show 'version mismatch', not just a synchronization failure. Option B is wrong because if the HA heartbeat interface is down, the cluster would show 'heartbeat lost' or 'standalone' status, not 'synchronization failed'—the units would not be able to communicate at all. Option C is wrong because NAT policies are a data-plane configuration and do not affect HA configuration synchronization, which is a control-plane function.
An administrator is investigating a security incident using FortiAnalyzer logs. The admin wants to identify all traffic that matched a specific firewall policy. Which TWO log fields should the admin use to filter the logs?
The policy ID directly identifies the firewall policy that processed the traffic.
Why this answer
In FortiAnalyzer logs, the policy ID (usually 'policyid' or 'policy_id') and source interface (e.g., 'srcintf') are key fields to identify which firewall policy matched the traffic. Other fields like destination IP or user name are not directly tied to the policy ID.
A FortiGate in an HA cluster is experiencing intermittent session synchronization failures. The administrator runs 'diagnose sys ha dump sync-status' and sees that sessions are not being synchronized properly. Which TWO potential causes should the administrator investigate?
If the session table is too large, session synchronization may fail due to resource constraints.
Why this answer
Session sync failures in HA can be caused by network issues on the heartbeat link or session table overload. Authentication or routing issues are less direct causes.
You are troubleshooting an SD-WAN rule where traffic is not matching the expected SLA. The FortiGate shows 'SLA mismatch' in logs. What is the MOST likely cause?
SLA mismatch occurs when the probe results do not meet the thresholds.
Why this answer
Option C is correct because an SLA mismatch typically indicates the interface's measured SLA parameters (latency, jitter, packet loss) do not meet the thresholds defined in the SLA rule. Option A would prevent rule matching entirely. Option B would not directly cause SLA mismatch.
Option D is not relevant.
Ready to test yourself?
Try a timed practice session using only Troubleshooting questions.