NSE4 High Availability and Diagnostics — 50 Questions

Question 1

A network engineer is configuring an SD-WAN rule to steer voice traffic to the MPLS link with the lowest latency. The SLA target is set to latency < 50 ms and jitter < 10 ms. However, the MPLS link occasionally exceeds the latency threshold. What should the engineer do to ensure voice traffic uses the best available link without manual intervention?

Accepted Answer

Configure the SD-WAN rule with a secondary strategy to use the broadband link when SLA is not met.. Option B is correct because configuring a secondary strategy (e.g., fallback to broadband) allows the SD-WAN rule to automatically steer voice traffic to the best available link when the primary MPLS link fails the SLA (latency > 50 ms). This ensures continuous SLA compliance without manual intervention, leveraging Fortinet's SD-WAN dynamic path selection based on real-time performance metrics.

Answer

Remove the latency performance SLA and rely only on jitter.

Answer

Increase the jitter threshold to 15 ms to avoid SLA violations.

Answer

Disable SLA enforcement on the SD-WAN rule so voice traffic always uses the MPLS link.

Question 2

An administrator has two FortiGate units in an active-passive HA cluster. The cluster is configured to use the heartbeat interface port3. During a failover test, the primary unit fails but the secondary does not take over. What is the most likely cause?

Accepted Answer

The heartbeat interface (port3) is down on the secondary unit.. In an active-passive HA cluster, the secondary unit monitors the primary's health via the heartbeat interface. If the heartbeat interface (port3) is down on the secondary, it cannot receive or send heartbeat packets, so it will not detect the primary's failure and will not initiate a failover. This is the most direct cause of the secondary not taking over.

Answer

The secondary unit has an override enabled.

Answer

Session pickup is disabled on the cluster.

Answer

The HA uptime on the secondary is less than the primary.

Question 3

A company has two remote sites connected via an SD-WAN overlay. The headquarters uses a FortiGate with two WAN links: Fiber (priority 1) and LTE (priority 2). The SD-WAN rule for business-critical traffic uses the 'best quality' strategy with SLA targets for latency and jitter. The fiber link occasionally experiences high jitter but low latency. The engineer notices that traffic is not failing over to LTE even when jitter exceeds the threshold. What is the most likely reason?

Accepted Answer

The performance SLA for jitter is not configured, only latency.. Option A is correct because the SD-WAN rule uses the 'best quality' strategy, which selects the best link based on configured SLA metrics. If only latency is configured in the performance SLA, jitter exceeding the threshold will not trigger a failover, as the SLA only evaluates the configured metrics. The fiber link may still meet the latency SLA, so traffic remains on it despite high jitter.

Answer

The SD-WAN rule has SLA match set to 'either' instead of 'all'.

Answer

The LTE link has a higher cost and is not considered for failover.

Answer

The fiber link has a higher interface weight.

Question 4

In an active-active HA cluster, which of the following must be identical on both FortiGate units?

Accepted Answer

Virtual cluster ID. In an active-active HA cluster, the virtual cluster ID must be identical on both FortiGate units because it defines the cluster group and ensures that only units with the same ID can form an HA cluster. This ID is used in heartbeat packets to verify cluster membership and prevent accidental merging of separate clusters. Without a matching virtual cluster ID, the units will not recognize each other as part of the same HA group.

Answer

HA priority

Answer

Management IP address

Answer

Hostname

Question 5

An SD-WAN rule is configured with a 'manual' strategy and multiple members. The engineer wants to ensure that voice traffic always uses the MPLS link as long as it meets the SLA, otherwise use the broadband link. Which configuration is required?

Accepted Answer

Set the manual strategy with MPLS as first member and enable SLA check.. Option B is correct because a manual strategy with ordered members and an SLA check allows the SD-WAN rule to first attempt the MPLS link; if the SLA is met, traffic uses MPLS, and if the SLA fails, the rule automatically fails over to the next member (broadband). This directly implements the engineer's requirement of 'MPLS if SLA met, otherwise broadband.'

Answer

Set the strategy to 'volume' and configure MPLS as preferred.

Answer

Use 'load balancing' strategy and assign MPLS a higher weight.

Answer

Set the strategy to 'best quality' and set MPLS with highest priority.

Question 6

Which TWO statements about FortiGate HA heartbeat interfaces are correct?

Accepted Answer

Heartbeat interfaces must be on the same subnet.. Option C is correct because FortiGate HA heartbeat interfaces must be on the same subnet to allow the heartbeat packets (typically UDP port 496) to be exchanged directly between the primary and secondary units. This ensures Layer 2 adjacency is maintained for reliable failure detection and synchronization.

Answer

Heartbeat interfaces must be in the same VDOM.

Answer

Heartbeat interfaces must be dedicated management ports.

Answer

Only two heartbeat interfaces can be configured.

Question 7

Which THREE statements about SD-WAN rules are correct?

Accepted Answer

SD-WAN rules are evaluated in order of priority.. SD-WAN rules are evaluated in order of priority, meaning the rule with the highest priority (lowest number) is matched first. This sequential evaluation ensures deterministic traffic steering based on the most specific match criteria defined by the administrator.

Answer

SD-WAN rules must use a 'load balancing' strategy.

Answer

Each SD-WAN rule can only contain one member.

Question 8

Refer to the exhibit. An administrator has configured HA on two FortiGate units. During a failover test, the secondary unit does not take over when the primary fails. What is the most likely cause?

Accepted Answer

The heartbeat interface (port3) is down on the secondary unit.. In an HA cluster, the heartbeat interface is critical for communication between primary and secondary units. If the heartbeat interface (port3) is down on the secondary unit, it cannot receive or send HA heartbeat packets, so the secondary will not detect the primary's failure or negotiate a takeover. This directly prevents the secondary from assuming the primary role, making D the correct answer.

Answer

Session pickup is enabled but session-pickup-connectionless is also enabled, causing conflict.

Answer

Override is disabled, so the secondary cannot become primary.

Answer

The priority on the secondary is set to a higher value than the primary.

Question 9

Refer to the exhibit. An SD-WAN rule for voice traffic uses the SLA strategy with sla-match-mode 'any'. SLA 'sla1' measures ping to 8.8.8.8. If wan1 has latency 90 ms and jitter 10 ms, and wan2 has latency 110 ms and jitter 5 ms, which link will be selected for voice traffic?

Accepted Answer

wan1, because it meets the SLA thresholds.. With sla-match-mode 'any', the SD-WAN rule selects the first link that meets any of the configured SLA thresholds. The SLA for voice traffic measures ping to 8.8.8.8 with thresholds for latency and jitter. wan1 has latency 90 ms and jitter 10 ms, which both fall within typical SLA thresholds (e.g., latency < 150 ms, jitter < 20 ms), so it meets the SLA. wan2 has latency 110 ms, which also meets the latency threshold, but since 'any' mode selects the first qualifying link, wan1 is chosen. Option B is correct because wan1 satisfies the SLA and is selected first.

Answer

Neither link, because both fail jitter?

Answer

Both links, because sla-match-mode 'any' allows any link that meets SLA.

Answer

wan2, because it has lower jitter.

Question 10

A company has two FortiGate 100F units in an active-passive HA cluster with firmware version 7.2.5. The cluster is configured with session pickup and all interfaces are monitored. The network consists of three VLANs: VLAN10 (Users), VLAN20 (Servers), and VLAN30 (DMZ). The cluster is connected to two ISPs: ISP1 (port1) and ISP2 (port2). The internal network uses a single aggregated link (port3 and port4) as a LAG to the core switch. One day, the primary FortiGate experiences a hardware failure and the secondary takes over. After the primary is replaced and rejoins the cluster, the administrator notices that traffic passing through the cluster is intermittently dropping for a few seconds every minute. The administrator checks the cluster status and sees that the new primary (previously secondary) is in 'primary' state and the old primary (newly replaced) is in 'secondary' state. What is the most likely cause of the intermittent traffic drops?

Accepted Answer

The LAG configuration on the new FortiGate does not match the active cluster configuration.. The most likely cause is that the LAG configuration on the newly replaced FortiGate does not match the active cluster configuration. In an HA cluster, all LAG member interfaces (port3 and port4) must have identical settings—including LACP mode, speed, duplex, and VLAN membership—on both units. When the secondary FortiGate became primary and the replaced unit rejoined as secondary, any mismatch in the LAG configuration would cause the cluster to continuously renegotiate or flap the aggregated link, leading to intermittent traffic drops every few seconds as the HA cluster attempts to synchronize and stabilize the interface state.

Answer

Session pickup is not enabled on the new FortiGate.

Answer

The HA cluster is in split-brain state.

Answer

The heartbeat interface is configured on the LAG, causing HA instability.

Question 11

A network engineer is configuring SD-WAN on a FortiGate with two WAN links: MPLS (port1) and Internet (port2). The MPLS link has lower latency and jitter. The engineer wants to route all VoIP traffic (SIP and RTP) over the MPLS link unless it is unavailable. Which SD-WAN rule configuration should be used?

Accepted Answer

Create an SD-WAN rule for VoIP traffic with strategy 'manual' or 'prefer' and select MPLS as the preferred member, with Internet as backup.. Option C is correct because the engineer requires a deterministic routing policy where VoIP traffic always uses the MPLS link unless it fails. The 'manual' (or 'prefer') strategy in SD-WAN rules allows you to explicitly set a preferred member (MPLS) and designate the other link (Internet) as a backup, ensuring failover only when the preferred link is unavailable. This matches the requirement of routing all VoIP traffic over MPLS unless it is unavailable, without relying on SLA performance metrics.

Answer

Create an SD-WAN rule for VoIP traffic with strategy 'best quality' and set the SLA target for latency to 10ms on the MPLS link.

Answer

Create an SD-WAN rule for VoIP traffic with strategy 'load balancing' and assign equal weight to both links.

Answer

Create an SD-WAN rule for VoIP traffic with strategy 'best quality' and set the SLA target to prefer the Internet link.

Question 12

A FortiGate is configured in an A-P HA cluster. The administrator wants to ensure that session failover occurs for UDP-based voice traffic. Which TWO settings must be enabled?

Accepted Answer

Enable UDP session synchronization.. Option A is correct because UDP session synchronization must be enabled to replicate UDP session state between HA cluster members, ensuring that active sessions for voice traffic (which typically uses UDP) are seamlessly taken over by the standby unit during a failover. Without this setting, UDP sessions are not synchronized by default, and voice calls would drop.

Answer

Set HA override to enabled.

Answer

Enable configuration synchronization.

Answer

Set failover hold time to 1 second.

Question 13

Refer to the exhibit. The HA cluster has been operational for 5 days. The primary unit suddenly loses power. Which of the following will happen?

Accepted Answer

The secondary unit will become primary and maintain existing UDP sessions.. In a FortiGate HA cluster, session synchronization is enabled by default for UDP sessions but not for TCP sessions (unless specifically configured). When the primary unit fails, the secondary unit takes over as primary and maintains all synchronized sessions, which includes UDP sessions. TCP sessions are not synchronized by default and will be dropped upon failover.

Answer

The secondary unit will become primary, but all existing sessions will be dropped.

Answer

The cluster will remain without a primary until the original unit is restored.

Answer

The secondary unit will become primary and maintain only TCP sessions.

Question 14

Drag and drop the steps to configure HA (High Availability) on a FortiGate pair into the correct order.

Question 15

Match each FortiGate routing concept to its definition.

Question 16

An administrator has configured an active-passive HA cluster. During a failover test, the standby unit becomes active but existing user sessions are lost, requiring users to re-establish connections. Which configuration change would prevent this behavior?

Accepted Answer

Enable session pickup. Session synchronization (session sync) replicates active sessions to the standby unit so that sessions survive a failover.

Answer

Lower HA priority on the primary

Answer

Set HA override to enabled

Answer

Increase the heartbeat interval

Question 17

A network administrator runs the following CLI command on a FortiGate to capture traffic for troubleshooting: 'diagnose sniffer packet any "host 10.0.1.100" 4'. What does the '4' at the end of the command specify?

Accepted Answer

The maximum number of packets to capture. The fourth parameter in the diagnose sniffer packet command specifies the number of packets to capture.

Answer

The filter verbosity level

Answer

The time duration in seconds

Answer

The interface index

Question 18

In an active-active HA cluster, the administrator notices that traffic is not being load-balanced evenly across both units. What is the most likely cause?

Accepted Answer

The load balance method is set to 'none'. In active-active HA, load balancing requires a load-balance method (like source IP hash or round-robin). Without a proper method, traffic may not distribute evenly.

Answer

The heartbeat interface speed is mismatched

Answer

The load balance method is set to 'source-ip' which naturally causes imbalance

Answer

The cluster is using active-passive mode

Question 19

An administrator executes 'diagnose debug flow' for a specific session and sees the output: 'id=20085 trace_id=10 func=print_pkt_detail line=5567 msg="vd-root:0 received packet via port1".' Later, the trace shows 'msg="Deny by policy"'. What is the most likely next step the administrator should take?

Accepted Answer

Review the firewall policies that apply to the traffic and modify as needed. The debug flow indicates the packet is denied by a firewall policy. The admin should identify which policy is blocking it and adjust accordingly.

Answer

Check the routing table for the destination

Answer

Restart the FortiGate to clear session table

Answer

Enable session helper for the protocol

Question 20

A FortiGate administrator needs to send logs to an external FortiAnalyzer for centralized monitoring. Which log configuration step is required?

Accepted Answer

Add the FortiAnalyzer as a logging device in System > FortiAnalyzer. To send logs from a FortiGate to an external FortiAnalyzer for centralized monitoring, the administrator must add the FortiAnalyzer as a logging device under System > FortiAnalyzer. This step establishes the secure, authenticated connection (typically using FortiGate's proprietary protocol over TCP/514 or TCP/3000) and enables log forwarding to the FortiAnalyzer. Without this configuration, the FortiGate will not send logs to the FortiAnalyzer, even if other logging methods are enabled.

Answer

Configure syslog server

Answer

Enable FortiCloud logging

Answer

Enable disk logging on the FortiGate