NSE4 High Availability and Diagnostics — 20 Questions

Question 1

An administrator has two FortiGate units in an active-passive HA cluster. The cluster is configured to use the heartbeat interface port3. During a failover test, the primary unit fails but the secondary does not take over. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The heartbeat interface (port3) is down on the secondary unit.. In an active-passive HA cluster, the secondary unit monitors the primary's health via the heartbeat interface. If the heartbeat interface (port3) is down on the secondary, it cannot receive or send heartbeat packets, so it will not detect the primary's failure and will not initiate a failover. This is the most direct cause of the secondary not taking over.

Answer

The secondary unit has an override enabled.

Answer

Session pickup is disabled on the cluster.

Answer

The HA uptime on the secondary is less than the primary.

Question 2

An SD-WAN rule is configured with a 'manual' strategy and multiple members. The engineer wants to ensure that voice traffic always uses the MPLS link as long as it meets the SLA, otherwise use the broadband link. Which configuration is required?

Accepted Answer

Set the manual strategy with MPLS as first member and enable SLA check.. A manual strategy with ordered members and an SLA check allows the SD-WAN rule to first attempt the MPLS link; if the SLA is met, traffic uses MPLS, and if the SLA fails, the rule automatically fails over to the next member (broadband). This directly implements the engineer's requirement of 'MPLS if SLA met, otherwise broadband.'

Answer

Set the strategy to 'volume' and configure MPLS as preferred.

Answer

Use 'load balancing' strategy and assign MPLS a higher weight.

Answer

Set the strategy to 'best quality' and set MPLS with highest priority.

Question 3

Refer to the exhibit. An administrator has configured HA on two FortiGate units. During a failover test, the secondary unit does not take over when the primary fails. What is the most likely cause?

Accepted Answer

The heartbeat interface (port3) is down on the secondary unit.. In an HA cluster, the heartbeat interface is critical for communication between primary and secondary units. If the heartbeat interface (port3) is down on the secondary unit, it cannot receive or send HA heartbeat packets, so the secondary will not detect the primary's failure or negotiate a takeover. This directly prevents the secondary from assuming the primary role, making D the correct answer.

Answer

Session pickup is enabled but session-pickup-connectionless is also enabled, causing conflict.

Answer

Override is disabled, so the secondary cannot become primary.

Answer

The priority on the secondary is set to a higher value than the primary.

Question 4

Refer to the exhibit. An SD-WAN rule for voice traffic uses the SLA strategy with sla-match-mode 'any'. SLA 'sla1' measures ping to 8.8.8.8. If wan1 has latency 90 ms and jitter 10 ms, and wan2 has latency 110 ms and jitter 5 ms, which link will be selected for voice traffic?

Accepted Answer

wan1, because it meets the SLA thresholds.. With sla-match-mode 'any', the SD-WAN rule selects the first link that meets any of the configured SLA thresholds. The SLA for voice traffic measures ping to 8.8.8.8 with thresholds for latency and jitter. wan1 has latency 90 ms and jitter 10 ms, which both fall within typical SLA thresholds (e.g., latency < 150 ms, jitter < 20 ms), so it meets the SLA. wan2 has latency 110 ms, which also meets the latency threshold, but since 'any' mode selects the first qualifying link, wan1 is chosen. Option B is correct because wan1 satisfies the SLA and is selected first.

Answer

Neither link, because both fail jitter?

Answer

Both links, because sla-match-mode 'any' allows any link that meets SLA.

Answer

wan2, because it has lower jitter.

Question 5

A network engineer is configuring SD-WAN on a FortiGate with two WAN links: MPLS (port1) and Internet (port2). The MPLS link has lower latency and jitter. The engineer wants to route all VoIP traffic (SIP and RTP) over the MPLS link unless it is unavailable. Which SD-WAN rule configuration should be used?

Accepted Answer

Create an SD-WAN rule for VoIP traffic with strategy 'manual' or 'prefer' and select MPLS as the preferred member, with Internet as backup.. The engineer requires a deterministic routing policy where VoIP traffic always uses the MPLS link unless it fails. The 'manual' strategy in SD-WAN rules allows you to explicitly set a preferred member (MPLS) and designate the other link (Internet) as a backup, ensuring failover only when the preferred link is unavailable. This matches the requirement of routing all VoIP traffic over MPLS unless it is unavailable, without relying on SLA performance metrics.

Answer

Create an SD-WAN rule for VoIP traffic with strategy 'best quality' and set the SLA target for latency to 10ms on the MPLS link.

Answer

Create an SD-WAN rule for VoIP traffic with strategy 'load balancing' and assign equal weight to both links.

Answer

Create an SD-WAN rule for VoIP traffic with strategy 'best quality' and set the SLA target to prefer the Internet link.

Question 6

Refer to the exhibit. The HA cluster has been operational for 5 days. The primary unit suddenly loses power. Which of the following will happen?

Accepted Answer

The secondary unit will become primary and maintain existing UDP sessions.. In a FortiGate HA cluster, session synchronization is enabled by default for UDP sessions but not for TCP sessions (unless specifically configured). When the primary unit fails, the secondary unit takes over as primary and maintains all synchronized sessions, which includes UDP sessions. TCP sessions are not synchronized by default and will be dropped upon failover.

Answer

The secondary unit will become primary, but all existing sessions will be dropped.

Answer

The cluster will remain without a primary until the original unit is restored.

Answer

The secondary unit will become primary and maintain only TCP sessions.

Question 7

Drag and drop the steps to configure HA (High Availability) on a FortiGate pair into the correct order.

Accepted Answer

Connect HA interfaces physically, then configure HA settings (mode, password, priority), then configure interface monitoring, then reboot.. HA configuration requires physical connection, mode selection, priority, and interface monitoring before reboot.

Answer

Connect HA interfaces physically, then configure interface monitoring, then configure HA settings, then reboot.

Answer

Configure HA settings first, then connect HA interfaces physically, then configure interface monitoring, then reboot.

Answer

Connect HA interfaces physically, then configure HA settings, then reboot, then configure interface monitoring.

Question 8

A network administrator runs the following CLI command on a FortiGate to capture traffic for troubleshooting: 'diagnose sniffer packet any "host 10.0.1.100" 4'. What does the '4' at the end of the command specify?

Accepted Answer

The filter verbosity level. In the 'diagnose sniffer packet' command, the fourth parameter specifies the verbosity level. A value of 4 sets the verbosity to display full packet details including headers and payload. The third parameter is the filter, and the second is the interface. The number of packets is controlled separately by other means, such as manually stopping the capture or using a time limit.

Answer

The maximum number of packets to capture

Answer

The time duration in seconds

Answer

The interface index

Question 9

In an active-active HA cluster, the administrator notices that traffic is not being load-balanced evenly across both units. What is the most likely cause?

Accepted Answer

The load balance method is set to 'none'. In an active-active HA cluster, traffic load balancing is controlled by the load balance method. If set to 'none', the cluster does not distribute traffic across units, causing uneven load. The correct method, such as 'source-ip' or 'round-robin', must be configured to achieve balance.

Answer

The heartbeat interface speed is mismatched

Answer

The load balance method is set to 'source-ip' which naturally causes imbalance

Answer

The cluster is using active-passive mode

Question 10

A FortiGate administrator needs to block a specific application using the FortiGuard Application Control service. Which two objects must be correctly configured in the firewall policy to achieve this? (Choose the best single answer describing the required object types.)

Accepted Answer

An application control profile and a firewall policy. Application Control requires a security profile and a firewall policy that references it.

Answer

An antivirus profile and a routing policy

Answer

A URL filter profile and a NAT policy

Answer

A web filter profile and an SSL inspection profile

Question 11

An administrator is troubleshooting a VPN tunnel that fails to establish. Which TWO CLI commands would provide the most relevant diagnostic information? (Choose two.)

Accepted Answer

diagnose debug application ike -1. Option C, `diagnose debug application ike -1`, is correct because it enables real-time, verbose IKE debugging on FortiGate, showing the actual Phase 1/Phase 2 negotiation exchanges (proposals, DH group, authentication, and any failure reason) that explain why the tunnel will not come up. Option E, `diagnose vpn ike log`, is correct because it captures IKE daemon log messages for VPN negotiations, letting the administrator inspect the specific error or mismatch that aborts tunnel establishment. Option A, `show full-configuration vpn ipsec`, only displays the configured IPsec settings and does not reveal live negotiation failures, so it is less relevant for diagnosing an establishment problem. Option B, `execute ping-options source`, merely sets the source address for subsequent pings and provides no IKE/IPsec diagnostic data. Option D, `get system performance status`, reports general CPU, memory, and session statistics, which do not identify why the VPN tunnel fails to establish.

Answer

show full-configuration vpn ipsec

Answer

execute ping-options source

Answer

get system performance status

Question 12

A FortiGate administrator wants to ensure that logs are retained even after a power outage. Which THREE storage options provide persistent log storage? (Choose three.)

Accepted Answer

Local disk logs. Option A (Local disk logs) is correct because FortiGate models with an internal disk or an attached storage device write logs to non-volatile storage, so entries survive a reboot or power loss. Option B (FortiAnalyzer) is correct because it is an external appliance/VM that receives and stores logs on its own persistent disk, providing centralized retention independent of the FortiGate's power state. Option C (FortiCloud) is correct because FortiCloud logging is a cloud-hosted service that stores logs off-box in persistent cloud storage, so they remain available after an outage. Option D (Syslog server) is not marked correct here because, although a syslog server can persist logs, it is not one of the three options designated as providing persistent storage in this question's answer key. Option E (Memory buffer logs) is incorrect because logs held in RAM are volatile and are lost when the FortiGate loses power or reboots.

Answer

Syslog server

Answer

Memory buffer logs

Question 13

A FortiGate administrator runs 'diagnose sys session filter dport 443' and then 'diagnose sys session list'. The output shows many sessions with 'proto_state=01' and 'expire=0'. What does this indicate about these sessions?

Accepted Answer

The sessions have expired and are being removed from the session table. In FortiGate session output, 'proto_state=01' indicates a TCP session in the ESTABLISHED state, and 'expire=0' means the session has no remaining lifetime and is being removed from the session table. Together they indicate the session is expired or in the process of being torn down, not actively passing traffic.

Answer

The sessions are for UDP traffic

Answer

The sessions are in the process of being established

Answer

The sessions are fully established and active

Question 14

A FortiGate administrator runs 'diagnose debug flow' and sees the output 'FW-6: packet is allowed by policy' but the packet is still dropped. What additional debug information should the administrator check to determine why the packet is dropped after being allowed?

Accepted Answer

Enable 'diagnose debug flow show function-name' to see more detailed stages. After policy lookup, further processing like security profiles, NAT, or routing may drop the packet. The 'function-name' parameter in debug flow shows deeper inspection stages.

Answer

Check the traffic log for the session

Answer

Check the session table for the packet

Answer

Run 'diagnose sniffer packet' to capture the packet

Question 15

A FortiGate administrator needs to configure an active-passive HA cluster to ensure that management access is available via a dedicated IP address that moves with the active unit. Which THREE configuration steps are required? (Choose three.)

Accepted Answer

Set the management interface under config system ha -> set ha-mgmt-status enable and assign an IP. To provide a floating management IP, the admin must set a dedicated management interface (which can be a physical interface or VLAN), assign an IP to that interface in the HA configuration, and ensure the interface is part of the HA managed interfaces so it synchronizes.

Answer

Configure a dedicated heartbeat interface

Answer

Assign a virtual MAC address to the management interface

Question 16

A network administrator is troubleshooting a FortiGate HA cluster that is not failing over as expected. The cluster consists of two units in active-passive mode. The administrator issues the command 'diagnose sys ha status' and sees that both units have the same priority. What is the most likely cause of the failover issue?

Accepted Answer

The HA heartbeat interfaces are not properly connected. In a FortiGate HA cluster, heartbeat interfaces are used for HA synchronization and failover detection. If they are not properly connected, the units cannot exchange heartbeat packets, so failover does not occur even if priorities differ. The identical priority is a red herring; the real issue is the broken heartbeat link.

Answer

The HA override setting is disabled

Answer

The HA mode is set to active-active instead of active-passive

Answer

The session pickup feature is enabled

Question 17

A FortiGate administrator needs to capture packets on interface port2 for 10 seconds to diagnose a connectivity issue. Which command should the administrator use?

Accepted Answer

diagnose sniffer packet port2 '' 4 10. The 'diagnose sniffer packet' command is used to capture packets on a FortiGate. The syntax 'diagnose sniffer packet port2 "" 4 10' captures packets on interface port2 for 10 seconds with verbose output (level 4). The empty filter '' captures all traffic.

Answer

diagnose sys session list port2 10

Answer

diagnose debug flow port2 10

Answer

execute sniffer port2 10

Question 18

You run 'diagnose sys session filter dport 443' and see the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate about the session?

Accepted Answer

The session is in the TCP SYN sent state, not yet fully established. The output shows `proto_state=01`, which in FortiGate session diagnostics indicates the TCP state. State 01 corresponds to SYN sent, meaning the session is in the process of establishing a TCP connection but has not yet completed the three-way handshake. The duration and expire values are typical for an active session, but the proto_state is the key indicator.

Answer

The session is using UDP protocol

Answer

The session has expired and is being removed

Answer

The session has completed the three-way handshake and is established

Question 19

An administrator configures a FortiGate to use FortiGuard for web filtering. However, some users report that certain categories are not being blocked as configured. The administrator checks the FortiGuard subscription status and it is valid. What is the most likely cause?

Accepted Answer

The FortiGate cannot reach the FortiGuard distribution servers. FortiGuard web filtering relies on the FortiGate being able to reach the FortiGuard Distribution Network (FDN) to download category ratings and updates. If the subscription is valid but categories are not being blocked, the most likely cause is that the FortiGate cannot reach the FortiGuard servers — for example, due to a missing DNS entry, blocked outbound HTTPS, or a broken route to the FDN. Without connectivity, the FortiGate falls back to cached or default ratings, so newly categorized sites are not filtered as configured.

Answer

The users are bypassing the FortiGate

Answer

The FortiGuard subscription has expired

Answer

The web filter profile is not applied to the firewall policy

Question 20

A FortiGate administrator is configuring an active-passive HA cluster and needs to ensure that management access is available via a dedicated management IP address that does not fail over. Which three steps should the administrator take? (Choose three.)

Accepted Answer

Assign an IP address to the management interface. The administrator must first configure a dedicated management interface, such as port3, so that management traffic is separated from the HA heartbeat and data interfaces (option E). That interface must then be assigned its own IP address, which provides the non-failing-over management access the scenario requires (option A). Finally, the administrator must ensure this management interface is not configured as a heartbeat interface, because heartbeat interfaces are used for HA synchronization and failover and would not provide a stable, dedicated management path (option D). Option B is incorrect because 'set ha-mgmt-interface' is not a valid FortiGate HA command for this purpose; the HA management interface is configured with 'set ha-mgmt-status enable' and 'set ha-mgmt-interface <interface>' under config system ha, but the option as written does not describe the required step. Option C is incorrect because the HA cluster management IP is a virtual IP that fails over between cluster members, which contradicts the requirement for a management IP that does not fail over.

Answer

Enable 'set ha-mgmt-interface' on the management interface

Answer

Set the management interface to be part of the HA cluster management IP