NSE4 High Availability and Diagnostics Practice Test 10 — 15 Questions

Question 1

An administrator wants to view the current session table on a FortiGate. Which command should they use?

Accepted Answer

diagnose sys session list. The command 'diagnose sys session list' displays the current session table on a FortiGate, showing active sessions with source/destination, protocol, state, and policy information. It is the standard CLI command for inspecting the session table in real time.

Answer

diagnose debug flow

Answer

show full-configuration

Answer

get system performance statistics

Question 2

A FortiGate administrator notices that the HA cluster is frequently failing over even though no hardware failure has occurred. The heartbeat link shows some packet loss. What is the best action to reduce unnecessary failovers?

Accepted Answer

Increase the failover threshold. The failover threshold (also called heartbeat loss threshold) determines how many consecutive heartbeat packets must be missed before a failover is triggered. By increasing this threshold, the FortiGate will tolerate more packet loss on the heartbeat link before declaring a failure, thus reducing unnecessary failovers caused by transient network issues. This directly addresses the root cause: intermittent packet loss on the heartbeat link. Lowering the interval would make the problem worse, and changing HA mode or disabling session sync does not affect failover sensitivity.

Answer

Lower the heartbeat interval

Answer

Change HA mode to active-active

Answer

Disable session synchronization

Question 3

Which of the following FortiGate log types records information about user authentication and administrative access?

Accepted Answer

Event logs. Event logs on a FortiGate record system-level and administrative activity, including administrator logins, configuration changes, user authentication events, and system operations. This is the log category that captures both user authentication and administrative access events, making it the correct answer. Traffic logs record session-level data (source/destination, bytes, action), while security logs cover UTM events like IPS and antivirus detections.

Answer

Traffic logs

Answer

System logs

Answer

Security logs

Question 4

A FortiGate administrator is diagnosing a performance issue. They notice that the CPU usage is consistently high. Which command can provide a real-time view of the processes consuming CPU?

Accepted Answer

diagnose sys top. 'diagnose sys top' provides a real-time, top-like view of running processes on the FortiGate, sorted by CPU and memory consumption, refreshing periodically. It is the correct tool to identify which specific process (e.g., ipsengine, wad, scanunitd) is driving sustained high CPU. This directly answers the need for a live process-level CPU view.

Answer

get system performance status

Answer

diagnose sys session stat

Answer

diagnose debug flow

Question 5

In a FortiGate HA cluster, the administrator needs to perform a firmware upgrade without causing a full service outage. Which procedure should be followed?

Accepted Answer

Upgrade the secondary unit first, then perform a failover, then upgrade the primary unit. In a FortiGate HA cluster, the correct upgrade procedure is to upgrade the secondary (subordinate) unit first, then trigger a failover so it becomes primary, then upgrade the former primary. This maintains service continuity because at least one unit is always running the stable firmware and passing traffic. Upgrading the primary first would cause an outage during the upgrade window.

Answer

Upgrade the primary unit first, then the secondary unit

Answer

Disable HA and upgrade each unit separately

Answer

Upgrade both units simultaneously

Question 6

Which FortiGate feature allows administrators to verify if a specific IP address is being blocked by a security policy?

Accepted Answer

diagnose debug flow. The 'diagnose debug flow' command allows administrators to trace the path of a packet through the FortiGate, showing which security policy, routing, and other checks it matches. By filtering on a specific IP address, administrators can see if traffic from that IP is being blocked by a policy and the reason for the block.

Answer

diagnose sys session list

Answer

get system ha status

Answer

diagnose sniffer packet

Question 7

A FortiGate administrator configures a ZTNA rule to protect an internal web server. The rule uses an access proxy. Which component on the FortiGate terminates the incoming ZTNA connection?

Accepted Answer

ZTNA gateway. In FortiGate ZTNA, the access proxy is hosted on the FortiGate itself, and the component that terminates the incoming ZTNA connection from the endpoint is the ZTNA gateway (also called the access proxy gateway). The ZTNA gateway performs the TLS termination and enforces the ZTNA rule, then proxies the traffic to the protected internal server. This is why the FortiGate can inspect and apply zero-trust policy without exposing the server directly.

Answer

ZTNA tag

Answer

SSL inspection profile

Answer

ZTNA application

Question 8

A FortiGate HA cluster is experiencing frequent failovers. The administrator checks the HA event log and sees repeated 'Heartbeat loss' messages. The heartbeat interfaces are connected directly via a crossover cable. What is the MOST likely cause?

Accepted Answer

The heartbeat interface has a duplex mismatch. A duplex mismatch on the heartbeat interface causes intermittent link errors and dropped heartbeat packets, leading to repeated 'Heartbeat loss' messages and frequent failovers. Since the interfaces are directly connected via crossover cable, a speed/duplex mismatch is the most likely physical-layer cause.

Answer

The session pickup option is enabled

Answer

The HA uptime monitor is enabled and tracking a failed interface

Answer

The HA override setting is disabled

Question 9

Which log severity level indicates that the system is unusable?

Accepted Answer

Emergency. The Emergency severity level (level 0) indicates that the system is unusable. It is the highest severity level in syslog (RFC 5424) and is used for catastrophic failures. Alert (level 1) indicates immediate action needed, Critical (level 2) indicates critical conditions, and Error (level 3) indicates error conditions, but Emergency specifically means the system is unusable.

Answer

Error

Answer

Critical

Answer

Alert

Question 10

An administrator needs to configure a FortiGate to send logs to an external FortiAnalyzer. Which setting is required?

Accepted Answer

Configuring FortiAnalyzer under Log Settings. FortiGate uses the 'Log Device' or 'FortiAnalyzer' configuration to send logs to an external FortiAnalyzer.

Answer

Setting the log disk quota

Answer

Configuring syslog server

Answer

Enabling FortiCloud logging

Question 11

An administrator wants to view the current session table entries filtered by destination port 443. Which command should be used?

Accepted Answer

diagnose sys session filter dport 443; diagnose sys session list. FortiGate session table inspection uses the 'diagnose sys session filter' command to set filter criteria (such as dport 443), followed by 'diagnose sys session list' to display matching entries. This two-step filter-then-list pattern is the correct syntax.

Answer

execute session list dport 443

Answer

diagnose debug flow filter dport 443

Answer

diagnose sys session list dport 443

Question 12

In an active-active HA cluster, session synchronization is configured. A new session is created on the primary unit. When does the secondary unit learn about this session?

Accepted Answer

Within a few milliseconds to seconds after creation. In an active-active HA cluster, FortiGate performs real-time session synchronization (session-pickup) between cluster members over the HA heartbeat link. When a new session is created on the primary, the session table entry is pushed to the secondary almost instantly — typically within milliseconds, though under load it can take up to a few seconds. This ensures that if a failover occurs, existing sessions continue without being dropped.

Answer

During the next heartbeat interval

Answer

After the session is closed

Answer

Immediately upon session creation

Question 13

An administrator configures HA override on a cluster with priority 200 on primary and 100 on secondary. The primary fails, secondary takes over. When primary recovers, what happens?

Accepted Answer

Primary immediately takes over as active. With HA override enabled, the primary unit with higher priority (200) will preempt the secondary (100) once it recovers and rejoins the cluster. The primary immediately takes over as active because override allows a higher-priority unit to force a failback. This is the intended behavior of override in FortiGate HA.

Answer

Both units become active, causing a conflict

Answer

Secondary remains active until next failover

Answer

The administrator must manually trigger failback

Question 14

Which type of log records information about firewall policy matches, such as allowed or denied traffic?

Accepted Answer

Traffic logs. Traffic logs in FortiGate record information about firewall policy matches, including allowed and denied traffic. They provide details such as source and destination IP addresses, ports, protocols, and the action taken by the firewall policy. This is the primary log type used for analyzing policy enforcement and troubleshooting connectivity issues.

Answer

Security logs

Answer

Event logs

Answer

Audit logs

Question 15

An administrator needs to configure HA on a pair of FortiGates with the following requirements: the cluster must support session failover for TCP, UDP, and ICMP; the management interface should be accessible on both units; and the failover must be triggered if port2 goes down. Which TWO settings must be configured? (Choose two.)

Accepted Answer

Enable session pickup. Option A (Enable session pickup) is correct because session pickup is the FortiGate HA setting that synchronizes session state tables across cluster members, which is exactly what enables TCP, UDP, and ICMP sessions to survive a failover to the other unit. Option C (Add port2 to the monitored interfaces) is correct because HA monitors only the interfaces explicitly listed in the monitored-interface configuration; adding port2 ensures that if that link goes down, the unit's HA priority is reduced or it fails over as required. Option B is not required because the requirement is that the management interface be reachable on both units, which is achieved by allowing management access on the HA interfaces or via reserved management interfaces, not by a mandatory dedicated management interface setting. Option D is not required because session failover and interface monitoring work in both active-passive and active-active modes, so the mode does not have to be active-passive. Option E is not required because override only controls whether a unit with higher priority preempts the primary after it recovers; it is not needed to trigger failover on a link-down event.

Answer

Configure a dedicated management interface

Answer

Set the HA mode to active-passive

Answer

Set the HA override to enabled