NSE4 High Availability and Diagnostics Practice Test 2 — 15 Questions

Question 1

A network administrator is troubleshooting a FortiGate HA cluster that is not failing over as expected. The cluster consists of two units in active-passive mode. The administrator issues the command 'diagnose sys ha status' and sees that both units have the same priority. What is the most likely cause of the failover issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The HA heartbeat interfaces are not properly connected. In a FortiGate HA cluster, heartbeat interfaces are used for HA synchronization and failover detection. If they are not properly connected, the units cannot exchange heartbeat packets, so failover does not occur even if priorities differ. The identical priority is a red herring; the real issue is the broken heartbeat link.

Answer

The HA override setting is disabled

Answer

The HA mode is set to active-active instead of active-passive

Answer

The session pickup feature is enabled

Question 2

A FortiGate administrator needs to capture packets on interface port2 for 10 seconds to diagnose a connectivity issue. Which command should the administrator use?

Accepted Answer

diagnose sniffer packet port2 '' 4 10. The 'diagnose sniffer packet' command is used to capture packets on a FortiGate. The syntax 'diagnose sniffer packet port2 "" 4 10' captures packets on interface port2 for 10 seconds with verbose output (level 4). The empty filter '' captures all traffic.

Answer

diagnose sys session list port2 10

Answer

diagnose debug flow port2 10

Answer

execute sniffer port2 10

Question 3

You run 'diagnose sys session filter dport 443' and see the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate about the session?

Accepted Answer

The session is in the TCP SYN sent state, not yet fully established. The output shows `proto_state=01`, which in FortiGate session diagnostics indicates the TCP state. State 01 corresponds to SYN sent, meaning the session is in the process of establishing a TCP connection but has not yet completed the three-way handshake. The duration and expire values are typical for an active session, but the proto_state is the key indicator.

Answer

The session is using UDP protocol

Answer

The session has expired and is being removed

Answer

The session has completed the three-way handshake and is established

Question 4

An administrator configures a FortiGate to use FortiGuard for web filtering. However, some users report that certain categories are not being blocked as configured. The administrator checks the FortiGuard subscription status and it is valid. What is the most likely cause?

Accepted Answer

The FortiGate cannot reach the FortiGuard distribution servers. FortiGuard web filtering relies on the FortiGate being able to reach the FortiGuard Distribution Network (FDN) to download category ratings and updates. If the subscription is valid but categories are not being blocked, the most likely cause is that the FortiGate cannot reach the FortiGuard servers — for example, due to a missing DNS entry, blocked outbound HTTPS, or a broken route to the FDN. Without connectivity, the FortiGate falls back to cached or default ratings, so newly categorized sites are not filtered as configured.

Answer

The users are bypassing the FortiGate

Answer

The FortiGuard subscription has expired

Answer

The web filter profile is not applied to the firewall policy

Question 5

A FortiGate administrator is configuring an active-passive HA cluster and needs to ensure that management access is available via a dedicated management IP address that does not fail over. Which three steps should the administrator take? (Choose three.)

Accepted Answer

Assign an IP address to the management interface. The administrator must first configure a dedicated management interface, such as port3, so that management traffic is separated from the HA heartbeat and data interfaces (option E). That interface must then be assigned its own IP address, which provides the non-failing-over management access the scenario requires (option A). Finally, the administrator must ensure this management interface is not configured as a heartbeat interface, because heartbeat interfaces are used for HA synchronization and failover and would not provide a stable, dedicated management path (option D). Option B is incorrect because 'set ha-mgmt-interface' is not a valid FortiGate HA command for this purpose; the HA management interface is configured with 'set ha-mgmt-status enable' and 'set ha-mgmt-interface <interface>' under config system ha, but the option as written does not describe the required step. Option C is incorrect because the HA cluster management IP is a virtual IP that fails over between cluster members, which contradicts the requirement for a management IP that does not fail over.

Answer

Enable 'set ha-mgmt-interface' on the management interface

Answer

Set the management interface to be part of the HA cluster management IP

Question 6

You run 'diagnose sys session filter dport 443' and see the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate about the session?

Accepted Answer

The session is initiating a TCP connection and has not yet completed the handshake. proto_state=01 means TCP SYN_SENT state, meaning the three-way handshake is incomplete. The session is still establishing.

Answer

The session has expired and will be removed in 1 second

Answer

The session is closing and has 3599 seconds until the entry is removed

Answer

The session is fully established and has been active for 3600 seconds

Question 7

An administrator is troubleshooting a policy that should allow HTTP traffic but it is being blocked. They run 'diagnose debug flow' and see the output ends with 'msg=deny by forward policy check'. What is the most likely cause?

Accepted Answer

The policy is configured with action DENY. The message indicates the packet was denied by a firewall policy, meaning there is no matching policy or the matching policy has action DENY.

Answer

The routing table is missing a default route

Answer

The session table is full

Answer

The HTTP traffic is not matching any policy

Question 8

An administrator runs 'diagnose sys session list' and sees a session with 'expire=0'. What does this indicate?

Accepted Answer

The session has expired and will be removed soon. In FortiGate session output, 'expire=0' indicates that the session has expired and is about to be removed from the session table. The expire value counts down to zero, at which point the session is deleted. It does not mean the session is permanent or long-lived.

Answer

The session is a long-lived session that does not expire

Answer

The session has been idle for 0 seconds

Answer

The session is permanently established and will not expire

Question 9

A FortiGate HA cluster in active-passive mode is experiencing unexpected failovers. The administrator suspects the heartbeat link is unreliable. Which TWO actions would help diagnose the heartbeat link issue? (Select two.)

Accepted Answer

Ping the heartbeat interface IP from the peer unit. Pinging the heartbeat interface IP checks connectivity; enabling debug HA heartbeat provides detailed heartbeat status.

Answer

Disable session synchronization

Answer

Configure a dedicated heartbeat interface

Answer

Increase the HA hello timer

Question 10

You run 'diagnose sys session filter dport 443' and see the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate?

Accepted Answer

The TCP three-way handshake is incomplete; only SYN was sent. protocol 6 is TCP. proto_state=01 means TCP SYN_SENT. The session duration is 3600 seconds, expire 3599 seconds left.

Answer

The session is a UDP connection to port 443

Answer

The session will expire in 3600 seconds

Answer

The session has been established for 3600 seconds

Question 11

An administrator is troubleshooting a firewall policy that should apply application control. The application control profile is configured but traffic is not being inspected. The administrator runs 'diagnose debug flow' and sees that the traffic is hitting the correct policy. What could be the issue?

Accepted Answer

The firewall policy inspection mode is set to proxy-based. Application control requires flow-based inspection; if the policy is set to proxy-based, application control may not work.

Answer

The FortiGate has not downloaded the latest application signatures

Answer

The traffic is using encryption that prevents inspection

Answer

The application control profile is not enabled on the policy

Question 12

An administrator is configuring an active-passive HA pair. Which THREE of the following must be identical on both units for the cluster to form? (Choose three.)

Accepted Answer

HA password. Option C (HA password) must match because the two peers authenticate each other during HA negotiation, and a mismatched pre-shared HA password prevents the cluster from forming. Option D (Firmware version) must be identical because HA peers must run the same software release to maintain compatible HA protocol and state synchronization. Option E (Operation mode, NAT/Transparent) must match because the peers must process and forward traffic identically for the active-passive failover to work correctly. Option A (HA priority) is not required to be identical, since priority is used to determine which unit becomes active and should differ between peers. Option B (Hostname) is not required to be identical, as each unit needs a unique hostname for identification.

Answer

HA priority

Answer

Hostname

Question 13

An administrator is configuring an active-passive HA cluster and wants to ensure that the secondary unit can be monitored and managed directly via HTTPS even when it is not the primary. Which setting must be enabled?

Accepted Answer

Enable 'set management-ip' on the HA configuration. In active-passive HA, the management interface allows individual management of each unit. Enabling 'management interface' on a dedicated interface (or a VLAN) gives each unit its own IP address for out-of-band management, independent of the HA cluster IP.

Answer

Use the same IP address for both units with different ports

Answer

Configure a virtual IP address for management in the firewall policy

Answer

Set 'ha-mgmt-status enable' on the interface

Question 14

A FortiGate admin is troubleshooting intermittent VPN disconnections. The admin enables debug flow with 'diagnose debug flow filter daddr 10.0.0.1' and 'diagnose debug flow trace start 10'. The output shows 'msg: send to x.x.x.x via intf port1' but then immediately 'msg: no matching policy'. However, the firewall policy list shows a policy that should match. What is the most likely cause?

Accepted Answer

A static route is missing or incorrect, causing the traffic to exit the wrong interface. The debug flow output shows 'no matching policy' even though a policy exists, which indicates that the traffic is not matching the policy due to a routing issue. If a static route is missing or incorrect, the traffic may be exiting the wrong interface, so the policy's incoming interface does not match the actual incoming interface, resulting in no policy match.

Answer

The policy's source interface is not the incoming interface

Answer

The firewall policy is disabled

Answer

The VPN tunnel is down

Question 15

An admin is troubleshooting why a user's traffic is not being logged. The firewall policy has logging enabled at 'All Sessions'. The admin checks the traffic log and sees no entries for that user. The admin runs 'diagnose debug flow' and sees the traffic is matching the policy. What could be the issue?

Accepted Answer

The log queue is overflowing and logs are being dropped. The traffic matches the policy, so it is traversing the FortiGate, ruling out option A. The logging filter severity is not the issue because 'All Sessions' logs at 'information' severity by default. A full log disk (option D) would cause logs to be dropped, but the most common cause in this scenario is the log queue overflowing and dropping logs (option B). The FortiGate's log queue has a limited size; if logs are generated faster than they can be written to the disk, the queue overflows and logs are dropped, which is why traffic logs do not appear even though the policy matches.

Answer

The user's traffic is not traversing the FortiGate

Answer

The logging filter is set to only log 'emergency' severity

Answer

The log disk is full and cannot accept new logs