NSE4 High Availability and Diagnostics Practice Test 2 — 15 Questions

Question 1

In an active-active HA cluster, the administrator notices that traffic is not being load-balanced evenly across both units. What is the most likely cause?

Accepted Answer

The load balance method is set to 'none'. In active-active HA, load balancing requires a load-balance method (like source IP hash or round-robin). Without a proper method, traffic may not distribute evenly.

Answer

The heartbeat interface speed is mismatched

Answer

The load balance method is set to 'source-ip' which naturally causes imbalance

Answer

The cluster is using active-passive mode

Question 2

An administrator executes 'diagnose debug flow' for a specific session and sees the output: 'id=20085 trace_id=10 func=print_pkt_detail line=5567 msg="vd-root:0 received packet via port1".' Later, the trace shows 'msg="Deny by policy"'. What is the most likely next step the administrator should take?

Accepted Answer

Review the firewall policies that apply to the traffic and modify as needed. The debug flow indicates the packet is denied by a firewall policy. The admin should identify which policy is blocking it and adjust accordingly.

Answer

Check the routing table for the destination

Answer

Restart the FortiGate to clear session table

Answer

Enable session helper for the protocol

Question 3

A FortiGate administrator needs to send logs to an external FortiAnalyzer for centralized monitoring. Which log configuration step is required?

Accepted Answer

Add the FortiAnalyzer as a logging device in System > FortiAnalyzer. To send logs from a FortiGate to an external FortiAnalyzer for centralized monitoring, the administrator must add the FortiAnalyzer as a logging device under System > FortiAnalyzer. This step establishes the secure, authenticated connection (typically using FortiGate's proprietary protocol over TCP/514 or TCP/3000) and enables log forwarding to the FortiAnalyzer. Without this configuration, the FortiGate will not send logs to the FortiAnalyzer, even if other logging methods are enabled.

Answer

Configure syslog server

Answer

Enable FortiCloud logging

Answer

Enable disk logging on the FortiGate

Question 4

What is the purpose of the heartbeat interface in a FortiGate HA cluster?

Accepted Answer

To exchange HA heartbeat messages for health monitoring. The heartbeat interface in a FortiGate HA cluster is dedicated to exchanging HA heartbeat messages between cluster members. These messages are used to monitor the health and availability of each unit, enabling failover detection and ensuring cluster stability. It does not handle session synchronization, management access, or user traffic forwarding.

Answer

To synchronize session tables and configuration

Answer

To provide out-of-band management access

Answer

To forward user traffic between cluster members

Question 5

A FortiGate administrator needs to block a specific application using the FortiGuard Application Control service. Which two objects must be correctly configured in the firewall policy to achieve this? (Choose the best single answer describing the required object types.)

Accepted Answer

An application control profile and a firewall policy. Application Control requires a security profile and a firewall policy that references it.

Answer

An antivirus profile and a routing policy

Answer

A URL filter profile and a NAT policy

Answer

A web filter profile and an SSL inspection profile

Question 6

During a failover in an active-passive HA cluster, the newly active unit does not have the same session table as the previous primary, causing all existing sessions to drop. Which setting should the administrator verify?

Accepted Answer

The session pickup setting is enabled. Session synchronization must be enabled and properly configured to replicate sessions to the standby unit.

Answer

HA override is enabled on both units

Answer

The heartbeat interface is configured as a dedicated management interface

Answer

The cluster is operating in active-active mode

Question 7

Which log severity level indicates a failure that requires immediate attention?

Accepted Answer

Emergency. In Fortinet's FortiOS, log severity levels follow the standard syslog protocol (RFC 5424). The 'Emergency' level (severity 0) indicates a system is unusable or has experienced a critical failure that requires immediate administrator intervention, such as a hardware failure or a security breach. This is the highest severity level, designed to alert for urgent action.

Answer

Debug

Answer

Warning

Answer

Information

Question 8

An administrator notices that the FortiGate HA cluster has two units, but only one is shown as 'primary' and the other as 'standby'. The administrator did not configure any load balancing. Which HA mode is in use?

Accepted Answer

Active-passive. In active-passive HA, one unit is primary (active) and the other is standby (passive).

Answer

Load-balanced cluster

Answer

Standalone

Answer

Active-active

Question 9

A FortiGate admin wants to inspect SSL-encrypted traffic for threats using IPS. The admin creates an SSL inspection profile with 'full SSL inspection' and applies it to the policy. What additional configuration is necessary for the IPS engine to process the decrypted traffic?

Accepted Answer

Apply an IPS sensor to the same firewall policy. IPS inspection requires that the security profile (IPS sensor) is also applied to the same firewall policy. SSL inspection alone only decrypts; the IPS profile inspects the decrypted traffic.

Answer

Enable 'set ssl-ssh-profile' under the IPS sensor

Answer

Enable 'IPS' under the SSL inspection profile

Answer

Configure the FortiGate's CA certificate on clients

Question 10

An administrator is troubleshooting a VPN tunnel that fails to establish. Which TWO CLI commands would provide the most relevant diagnostic information? (Choose two.)

Accepted Answer

diagnose debug application ike -1. 'diagnose vpn ike log' provides detailed IKE negotiation logs; 'diagnose debug application ike -1' enables real-time IKE debugging. Both are essential for VPN troubleshooting.

Answer

show full-configuration vpn ipsec

Answer

execute ping-options source

Answer

get system performance status

Question 11

A FortiGate administrator wants to ensure that logs are retained even after a power outage. Which THREE storage options provide persistent log storage? (Choose three.)

Accepted Answer

Local disk logs. Local disk logs are stored on the FortiGate's hard drive, FortiAnalyzer is an external logging appliance, and FortiCloud provides cloud-based log storage. Syslog servers typically do not guarantee retention on the FortiGate side.

Answer

Syslog server

Answer

Memory buffer logs

Question 12

A FortiGate administrator has configured an active-passive HA cluster with two units. During a failover test, they notice that existing TCP sessions are dropped and must be re-established. What configuration change should the administrator make to ensure sessions are preserved during failover?

Accepted Answer

Enable session synchronization between the cluster members. Session synchronization (session sync) allows the active unit to share session table entries with the passive unit. During failover, the new active unit has the session table pre-populated, so existing sessions continue without interruption.

Answer

Configure a dedicated heartbeat interface

Answer

Enable HA override

Answer

Increase the HA priority on the primary unit

Question 13

Which FortiGate diagnostic command allows you to capture packets on an interface for troubleshooting network connectivity issues?

Accepted Answer

diagnose sniffer packet. The 'diagnose sniffer packet' command captures packets in real-time on a specified interface, similar to tcpdump. It is the primary tool for packet-level troubleshooting.

Answer

diagnose debug flow

Answer

diagnose sys session list

Answer

diagnose test application

Question 14

A FortiGate in an active-active HA cluster is experiencing asymmetric routing. The administrator runs 'diagnose debug flow' on a packet from a client to a server. The flow trace shows the packet is allowed by policy, but the response is dropped. What is the most likely cause?

Accepted Answer

The session synchronization is not enabled between cluster members. In active-active HA, asymmetric routing can cause session state issues because each unit may see only one direction of traffic. Without session synchronization and strict session pickup, the unit receiving the response may not have the session and drops it.

Answer

The TTL of the packet is too low

Answer

The HA mode should be changed to active-passive

Answer

The policy on the secondary unit has a different schedule

Question 15

A FortiGate administrator runs 'diagnose sys session filter dport 443' and then 'diagnose sys session list'. The output shows many sessions with 'proto_state=01' and 'expire=0'. What does this indicate about these sessions?

Accepted Answer

The sessions have expired and are being removed from the session table. In FortiGate session table, 'expire=0' means the session has expired (or is being cleaned up). 'proto_state=01' often indicates TCP SYN sent state. Sessions with expire=0 are not fully established or are closing.

Answer

The sessions are for UDP traffic

Answer

The sessions are in the process of being established

Answer

The sessions are fully established and active