NSE4 High Availability and Diagnostics Practice Test 2 — 15 Questions

Question 1

An administrator has configured an active-passive HA cluster. During a failover test, the standby unit becomes active but existing user sessions are lost, requiring users to re-establish connections. Which configuration change would prevent this behavior?

Accepted Answer

Enable session pickup. Session synchronization (session sync) replicates active sessions to the standby unit so that sessions survive a failover.

Answer

Lower HA priority on the primary

Answer

Set HA override to enabled

Answer

Increase the heartbeat interval

Question 2

A network administrator runs the following CLI command on a FortiGate to capture traffic for troubleshooting: 'diagnose sniffer packet any "host 10.0.1.100" 4'. What does the '4' at the end of the command specify?

Accepted Answer

The maximum number of packets to capture. The fourth parameter in the diagnose sniffer packet command specifies the number of packets to capture.

Answer

The filter verbosity level

Answer

The time duration in seconds

Answer

The interface index

Question 3

In an active-active HA cluster, the administrator notices that traffic is not being load-balanced evenly across both units. What is the most likely cause?

Accepted Answer

The load balance method is set to 'none'. In active-active HA, load balancing requires a load-balance method (like source IP hash or round-robin). Without a proper method, traffic may not distribute evenly.

Answer

The heartbeat interface speed is mismatched

Answer

The load balance method is set to 'source-ip' which naturally causes imbalance

Answer

The cluster is using active-passive mode

Question 4

An administrator executes 'diagnose debug flow' for a specific session and sees the output: 'id=20085 trace_id=10 func=print_pkt_detail line=5567 msg="vd-root:0 received packet via port1".' Later, the trace shows 'msg="Deny by policy"'. What is the most likely next step the administrator should take?

Accepted Answer

Review the firewall policies that apply to the traffic and modify as needed. The debug flow indicates the packet is denied by a firewall policy. The admin should identify which policy is blocking it and adjust accordingly.

Answer

Check the routing table for the destination

Answer

Restart the FortiGate to clear session table

Answer

Enable session helper for the protocol

Question 5

A FortiGate administrator needs to send logs to an external FortiAnalyzer for centralized monitoring. Which log configuration step is required?

Accepted Answer

Add the FortiAnalyzer as a logging device in System > FortiAnalyzer. To send logs from a FortiGate to an external FortiAnalyzer for centralized monitoring, the administrator must add the FortiAnalyzer as a logging device under System > FortiAnalyzer. This step establishes the secure, authenticated connection (typically using FortiGate's proprietary protocol over TCP/514 or TCP/3000) and enables log forwarding to the FortiAnalyzer. Without this configuration, the FortiGate will not send logs to the FortiAnalyzer, even if other logging methods are enabled.

Answer

Configure syslog server

Answer

Enable FortiCloud logging

Answer

Enable disk logging on the FortiGate

Question 6

What is the purpose of the heartbeat interface in a FortiGate HA cluster?

Accepted Answer

To exchange HA heartbeat messages for health monitoring. The heartbeat interface in a FortiGate HA cluster is dedicated to exchanging HA heartbeat messages between cluster members. These messages are used to monitor the health and availability of each unit, enabling failover detection and ensuring cluster stability. It does not handle session synchronization, management access, or user traffic forwarding.

Answer

To synchronize session tables and configuration

Answer

To provide out-of-band management access

Answer

To forward user traffic between cluster members

Question 7

An administrator runs 'diagnose sys session filter dport 443' and then 'diagnose sys session list'. The output shows many sessions with 'proto_state=01' and 'expire=3599'. What does 'expire=3599' indicate?

Accepted Answer

The session will timeout in 3599 seconds. In FortiGate diagnostics, the 'expire' field in the session list output indicates the remaining time in seconds before the session times out. A value of 3599 seconds means the session will be removed from the session table after that many seconds of inactivity, assuming no further traffic matches the session. This is a key metric for understanding session lifecycle and timeout behavior.

Answer

The session has 3599 packets

Answer

The session has been alive for 3599 seconds

Answer

The session has 3599 bytes of data transferred

Question 8

A FortiGate administrator needs to block a specific application using the FortiGuard Application Control service. Which two objects must be correctly configured in the firewall policy to achieve this? (Choose the best single answer describing the required object types.)

Accepted Answer

An application control profile and a firewall policy. Application Control requires a security profile and a firewall policy that references it.

Answer

An antivirus profile and a routing policy

Answer

A URL filter profile and a NAT policy

Answer

A web filter profile and an SSL inspection profile

Question 9

During a failover in an active-passive HA cluster, the newly active unit does not have the same session table as the previous primary, causing all existing sessions to drop. Which setting should the administrator verify?

Accepted Answer

The session pickup setting is enabled. Session synchronization must be enabled and properly configured to replicate sessions to the standby unit.

Answer

HA override is enabled on both units

Answer

The heartbeat interface is configured as a dedicated management interface

Answer

The cluster is operating in active-active mode

Question 10

Which log severity level indicates a failure that requires immediate attention?

Accepted Answer

Emergency. In Fortinet's FortiOS, log severity levels follow the standard syslog protocol (RFC 5424). The 'Emergency' level (severity 0) indicates a system is unusable or has experienced a critical failure that requires immediate administrator intervention, such as a hardware failure or a security breach. This is the highest severity level, designed to alert for urgent action.

Answer

Debug

Answer

Warning

Answer

Information

Question 11

An administrator notices that the FortiGate HA cluster has two units, but only one is shown as 'primary' and the other as 'standby'. The administrator did not configure any load balancing. Which HA mode is in use?

Accepted Answer

Active-passive. In active-passive HA, one unit is primary (active) and the other is standby (passive).

Answer

Load-balanced cluster

Answer

Standalone

Answer

Active-active

Question 12

A FortiGate admin wants to inspect SSL-encrypted traffic for threats using IPS. The admin creates an SSL inspection profile with 'full SSL inspection' and applies it to the policy. What additional configuration is necessary for the IPS engine to process the decrypted traffic?

Accepted Answer

Apply an IPS sensor to the same firewall policy. IPS inspection requires that the security profile (IPS sensor) is also applied to the same firewall policy. SSL inspection alone only decrypts; the IPS profile inspects the decrypted traffic.

Answer

Enable 'set ssl-ssh-profile' under the IPS sensor

Answer

Enable 'IPS' under the SSL inspection profile

Answer

Configure the FortiGate's CA certificate on clients

Question 13

An administrator is troubleshooting a VPN tunnel that fails to establish. Which TWO CLI commands would provide the most relevant diagnostic information? (Choose two.)

Accepted Answer

diagnose debug application ike -1. 'diagnose vpn ike log' provides detailed IKE negotiation logs; 'diagnose debug application ike -1' enables real-time IKE debugging. Both are essential for VPN troubleshooting.

Answer

show full-configuration vpn ipsec

Answer

execute ping-options source

Answer

get system performance status

Question 14

A FortiGate administrator wants to ensure that logs are retained even after a power outage. Which THREE storage options provide persistent log storage? (Choose three.)

Accepted Answer

Local disk logs. Local disk logs are stored on the FortiGate's hard drive, FortiAnalyzer is an external logging appliance, and FortiCloud provides cloud-based log storage. Syslog servers typically do not guarantee retention on the FortiGate side.

Answer

Syslog server

Answer

Memory buffer logs

Question 15

An active-passive HA cluster is experiencing frequent failovers. Which TWO factors could cause unnecessary failovers? (Choose two.)

Accepted Answer

Using a data interface as the heartbeat interface. Incorrect heartbeat interface configuration (e.g., using a busy data port) can cause false positives. A mismatched HA password prevents proper communication, but may not cause failover; mismatched priority affects role selection, not failover frequency. Unstable heartbeat links cause failover.

Answer

Different firmware versions on cluster members

Answer

Mismatched HA passwords between cluster members

Answer

Mismatched HA priority values