How should I use these Troubleshooting and Diagnostics practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just Troubleshooting and Diagnostics questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Troubleshooting and Diagnostics domain.

NSE7 · topic practice

Troubleshooting and Diagnostics practice questions

Practise Fortinet NSE 7 Advanced Security NSE7 Troubleshooting and Diagnostics practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: Troubleshooting and Diagnostics

Practice 10 questions Browse domain →

What the exam tests

What to know about Troubleshooting and Diagnostics

Troubleshooting and Diagnostics questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Troubleshooting and Diagnostics exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Troubleshooting and Diagnostics questions

20 questions · select your answer, then reveal the explanation

Question 1mediummulti select

Read the full Troubleshooting and Diagnostics explanation →

Which TWO actions are appropriate when troubleshooting a slow network connection through a FortiGate?

Trap 1: Increase the session TTL to reduce session setup overhead.

Changing session TTL does not address root cause and may exhaust resources.

Trap 2: Disable flow control on the WAN interface.

Disabling flow control can cause packet drops and worsen performance.

Trap 3: Disable all security profiles to free resources.

Disabling security profiles bypasses security and may not be necessary.

Study all Troubleshooting and Diagnostics common traps →

A
Increase the session TTL to reduce session setup overhead.
Why wrong: Changing session TTL does not address root cause and may exhaust resources.
B
Check the CPU and memory utilization on the FortiGate.
High resource usage can cause slowdowns; checking this is a standard diagnostic step.
C
Verify the routing table for correct next-hop entries.
Incorrect routing can cause traffic to take suboptimal paths, leading to slowness.
D
Disable flow control on the WAN interface.
Why wrong: Disabling flow control can cause packet drops and worsen performance.
E
Disable all security profiles to free resources.
Why wrong: Disabling security profiles bypasses security and may not be necessary.

Troubleshooting and Diagnostics practice questions

What to know about Troubleshooting and Diagnostics

Common Troubleshooting and Diagnostics exam traps

Troubleshooting and Diagnostics questions

Which TWO actions are appropriate when troubleshooting a slow network connection through a FortiGate?

You are troubleshooting a BGP neighbor flapping. The neighbor state shows 'Active'. Which command will help you see the reason for the state change?

An administrator runs 'diagnose sys session filter dport 443' and sees output indicating sessions with state 'proto=6 proto_state=01 duration=3600 expire=3598'. What does this output indicate about the session?

A FortiGate HA cluster is experiencing persistent split-brain even after both units are rebooted. Which THREE actions should the administrator take to resolve this issue? (Choose three.)

A FortiGate is experiencing high memory usage due to a large number of UDP sessions. The administrator wants to reduce memory consumption without dropping legitimate traffic. Which THREE actions could help? (Choose three.)

An administrator is investigating a security incident using FortiAnalyzer logs. The admin needs to identify all connections from a specific internal IP (10.0.0.100) to external servers on TCP port 443 during the last hour. Which TWO log fields should be used to filter the logs? (Choose two.)

An administrator is troubleshooting a VPN tunnel between two FortiGates. The phase 1 fails to come up. The administrator runs 'diagnose vpn ike log' and sees the error 'no proposal chosen'. Which THREE configuration mismatches could cause this error?

A network admin is investigating a high CPU usage issue on a FortiGate firewall. The admin runs 'diagnose sys top' and sees that the 'ipsengine' process is consuming 70% CPU. Which THREE actions should the admin take to reduce CPU load?

An administrator is investigating a security incident using FortiAnalyzer logs. The admin wants to identify all traffic that matched a specific firewall policy. Which TWO log fields should the admin use to filter the logs?

A FortiGate in an HA cluster is experiencing intermittent session synchronization failures. The administrator runs 'diagnose sys ha dump sync-status' and sees that sessions are not being synchronized properly. Which TWO potential causes should the administrator investigate?

A FortiGate administrator notices that traffic from a specific subnet is being dropped unexpectedly. The security policy allows the traffic, and there are no firewall policies blocking it. What is the most efficient first step to identify the cause of the drops?

An organization uses FortiGate with OSPF and BGP. Recently, routes from BGP are not being preferred over OSPF routes, causing suboptimal routing. The administrator wants to ensure BGP routes are preferred. Which two actions can achieve this? (Choose two.)

A FortiGate is experiencing high CPU usage. The administrator runs 'diagnose sys top' and sees that the process 'ipsengine' is using the most CPU. What is the most likely cause?

An administrator is troubleshooting a VPN tunnel that is not coming up. The remote peer is a third-party device. Which THREE actions should be taken to diagnose the issue?

A FortiGate administrator sees the following kernel log: 'kernel: [pid 1234] received packet with unknown or unsupported protocol 0x0800 on interface port1, drop'. What does this log indicate?

Based on the debug flow output, what is the reason the packet is dropped?

Exhibit

An administrator applies the above policy but users from 10.0.1.0/24 cannot access web servers at 10.0.2.0/24. However, they can ping the servers. What is the most likely cause?

Exhibit

A FortiGate is experiencing high latency on traffic passing through it. The administrator suspects that asymmetric routing is occurring. Which TWO symptoms are indicative of asymmetric routing?

A FortiGate cluster (A-P) has a session that is not synchronizing to the secondary unit. The administrator runs 'diagnose sys ha session-sync status' and sees that the session count is different between primary and secondary. Which is the most likely cause?

A customer reports intermittent connectivity issues between two internal subnets separated by a FortiGate firewall. The traffic is allowed by the policy, but users experience timeouts during peak hours. Which troubleshooting step should you take first?

Track your progress over time

Start a Troubleshooting and Diagnostics only practice session

Related NSE7 topic practice pages

Advanced Networking and SD-WAN practice questions

Advanced VPN and Zero Trust practice questions

Enterprise Firewall and VDOMs practice questions

Advanced Threat Protection practice questions

Troubleshooting and Diagnostics practice questions

NSE7 fundamentals practice questions

NSE7 scenario practice questions

NSE7 troubleshooting practice questions

Frequently asked questions

Track your progress

Study resources

Exam traps to avoid