View all questions & answers for the FCSS - Network Security 7.4 Support Engineer Exam Materials exam
Question 13 Discussion
Comments
Selected Answers: A, B
Correct Answers (Per FortiOS 7.4.7 Administration Guide):
A. The FortiGate is flushing sessions because of high memory usage.
B. The FortiGate is deleting sessions because the kernel cannot allocate more memory pages.
Documentation Evidence:
Memory-Based Session Flushing (Option A)
Reference: FortiGate 7.4.7 Admin Guide > System > Memory
"When memory usage exceeds the red threshold (default: 88%), the FortiGate starts dropping new sessions and may flush existing ones to prevent system overload."
Why it fits: Random session drops occur when the device proactively clears sessions to free memory.
Kernel Memory Allocation Failure (Option B)
Reference: FortiGate 7.4.7 Admin Guide > Troubleshooting > Memory Issues
"If the kernel fails to allocate memory pages, the system terminates existing sessions to reclaim resources."
Why it fits: This explains abrupt session removals unrelated to traffic patterns.
Why Other Options Are Incorrect:
C. Dropping incomplete TCP handshakes:
This is normal behavior (per Security Profiles > Firewall), not a cause of random established session drops.
D. Device downtime (16/120 seconds):
HA-specific (per High Availability > Monitoring), irrelevant to standalone session flushing.
Key Takeaways from the Guide:
Memory thresholds dictate session management:
Red (88%) → New sessions blocked.
Extreme (95%) → Active sessions flushed.
Kernel-level issues cause abrupt drops:
Logs show kernel: allocate memory failed errors.
Final Answer:
✅ A & B are correct (memory pressure and kernel allocation failures are documented causes).
❌ C & D describe unrelated behaviors.
This aligns strictly with the 7.4.7 Administration Guide's memory and troubleshooting sections. Let me know if you'd like specific page references!
New Correct Answers (Per FortiOS 7.4.7 Administration Guide):
A. The FortiGate is flushing sessions because of high memory usage.
B. The FortiGate is deleting sessions because the kernel cannot allocate more memory pages.
Documentation Evidence:
Memory-Based Session Flushing (Option A)
Reference: FortiGate 7.4.7 Admin Guide > System > Memory
"When memory usage exceeds the red threshold (default: 88%), the FortiGate starts dropping new sessions and may flush existing ones to prevent system overload."
Why it fits: Random session drops occur when the device proactively clears sessions to free memory.
Kernel Memory Allocation Failure (Option B)
Reference: FortiGate 7.4.7 Admin Guide > Troubleshooting > Memory Issues
"If the kernel fails to allocate memory pages, the system terminates existing sessions to reclaim resources."
Why it fits: This explains abrupt session removals unrelated to traffic patterns.
Why Other Options Are Incorrect:
C. Dropping incomplete TCP handshakes:
This is normal behavior (per Security Profiles > Firewall), not a cause of random established session drops.
D. Device downtime (16/120 seconds):
HA-specific (per High Availability > Monitoring), irrelevant to standalone session flushing.
Key Takeaways from the Guide:
Memory thresholds dictate session management:
Red (88%) → New sessions blocked.
Extreme (95%) → Active sessions flushed.
Kernel-level issues cause abrupt drops:
Logs show kernel: allocate memory failed errors.
Final Answer:
✅ A & B are correct (memory pressure and kernel allocation failures are documented
Selected Answers: A, B
After carefully reviewing your comment & Study Guide, you were absolutely right. We’ve updated the correct answer on the website to reflect A & B
Page 63 of the Study Guide clearly supports answers A and B.
"Kernel deletes oldest sessions if it cannot allocate more memory pages"
"No direct link with conserve mode"
"FortiGate has one more mechanism to free memory when there is not much available. If the kernel cannot allocate more memory pages, it deletes the oldest sessions."
These statements confirm that session drops may occur due to high memory usage and the kernel’s inability to allocate memory — fully aligning with answers A and B
An administrator has noticed unusual behavior from FortiGate. It appears that sessions are randomly removed. Which two reasons could explain this? (Choose two answers)
Brave-Dump Clients Votes