NSE4 High Availability and Diagnostics Practice Test 3 — 15 Questions

Question 1

A FortiGate administrator has configured an active-passive HA cluster with two units. During a failover test, they notice that existing TCP sessions are dropped and must be re-established. What configuration change should the administrator make to ensure sessions are preserved during failover?

Accepted Answer

Enable session synchronization between the cluster members. Session synchronization (session sync) allows the active unit to share session table entries with the passive unit. During failover, the new active unit has the session table pre-populated, so existing sessions continue without interruption.

Answer

Configure a dedicated heartbeat interface

Answer

Enable HA override

Answer

Increase the HA priority on the primary unit

Question 2

Which FortiGate diagnostic command allows you to capture packets on an interface for troubleshooting network connectivity issues?

Accepted Answer

diagnose sniffer packet. The 'diagnose sniffer packet' command captures packets in real-time on a specified interface, similar to tcpdump. It is the primary tool for packet-level troubleshooting.

Answer

diagnose debug flow

Answer

diagnose sys session list

Answer

diagnose test application

Question 3

A FortiGate in an active-active HA cluster is experiencing asymmetric routing. The administrator runs 'diagnose debug flow' on a packet from a client to a server. The flow trace shows the packet is allowed by policy, but the response is dropped. What is the most likely cause?

Accepted Answer

The session synchronization is not enabled between cluster members. In active-active HA, asymmetric routing can cause session state issues because each unit may see only one direction of traffic. Without session synchronization and strict session pickup, the unit receiving the response may not have the session and drops it.

Answer

The TTL of the packet is too low

Answer

The HA mode should be changed to active-passive

Answer

The policy on the secondary unit has a different schedule

Question 4

A FortiGate administrator runs 'diagnose sys session filter dport 443' and then 'diagnose sys session list'. The output shows many sessions with 'proto_state=01' and 'expire=0'. What does this indicate about these sessions?

Accepted Answer

The sessions have expired and are being removed from the session table. In FortiGate session table, 'expire=0' means the session has expired (or is being cleaned up). 'proto_state=01' often indicates TCP SYN sent state. Sessions with expire=0 are not fully established or are closing.

Answer

The sessions are for UDP traffic

Answer

The sessions are in the process of being established

Answer

The sessions are fully established and active

Question 5

An organization wants to send FortiGate logs to a central log management system for long-term storage and compliance. Which FortiGate feature is specifically designed for collecting and analyzing logs from multiple FortiGate devices?

Accepted Answer

FortiAnalyzer. FortiAnalyzer is the central log management and analysis platform for Fortinet devices. It aggregates logs, generates reports, and provides long-term storage.

Answer

Disk logging

Answer

FortiGuard

Answer

FortiCloud

Question 6

A FortiGate administrator wants to see real-time debugging output for traffic matching a specific source IP address. Which command sequence would achieve this?

Accepted Answer

diagnose debug flow filter src 10.0.1.10 ; diagnose debug flow show function-name ; diagnose debug enable. Option B is correct because the 'diagnose debug flow' command sequence is specifically designed for real-time debugging of traffic flows, allowing filtering by source IP with the 'filter src' option. Enabling debug output with 'diagnose debug enable' then shows flow trace information for packets matching the filter, which is the standard method for live traffic debugging on FortiGate.

Answer

diagnose sys session filter src 10.0.1.10 ; diagnose sys session list

Answer

diagnose sniffer packet any 'host 10.0.1.10' 4

Answer

diagnose debug reset ; diagnose debug enable ; diagnose debug flow show iprope

Question 7

A FortiGate administrator has configured an active-passive HA cluster. After a failover event, the former primary unit comes back online and immediately takes over as primary again, causing another failover. The administrator wants the original primary to stay in standby until the current primary fails. Which setting should be configured?

Accepted Answer

Disable HA override on both units. HA override (set ha-override enable) causes a device to resume primary role when it becomes available with higher priority. Disabling override prevents this preemptive behavior.

Answer

Enable HA override on both units

Answer

Set the HA mode to active-active

Answer

Increase the HA priority on the primary unit

Question 8

Which FortiGate log severity level indicates that a system is unusable and requires immediate attention?

Accepted Answer

Emergency. Emergency is the highest severity level in syslog/FortiGate, indicating a system is unusable. Critical indicates critical conditions but not necessarily unusable.

Answer

Error

Answer

Critical

Answer

Alert

Question 9

A FortiGate administrator needs to ensure that traffic logs are sent to a FortiAnalyzer even when the FortiGate's local disk is full. What configuration is required?

Accepted Answer

Enable 'remote log' under Log Settings and specify the FortiAnalyzer IP. Configuring the FortiAnalyzer as a log destination ensures logs are sent immediately. The local disk issue does not affect remote logging. Optionally, the admin can set logging to 'fallback' or 'any', but the direct method is to configure the remote syslog/FortiAnalyzer.

Answer

Enable 'disk logging' with rollover policy

Answer

Increase the log severity to 'emergency' only

Answer

Configure a log filter to send only security logs

Question 10

A FortiGate administrator notices that after upgrading the firmware, the HA cluster fails to form. Both units show the correct HA configuration. What is the most likely cause?

Accepted Answer

The firmware versions are different on the two units. HA clusters require all members to run the same firmware version. Mismatched firmware prevent cluster formation.

Answer

The HA heartbeat interfaces are not connected

Answer

The HA mode is set to active-active on one unit and active-passive on the other

Answer

The HA priority values are identical

Question 11

A FortiGate administrator runs 'diagnose debug flow' and sees the output 'FW-6: packet is allowed by policy' but the packet is still dropped. What additional debug information should the administrator check to determine why the packet is dropped after being allowed?

Accepted Answer

Enable 'diagnose debug flow show function-name' to see more detailed stages. After policy lookup, further processing like security profiles, NAT, or routing may drop the packet. The 'function-name' parameter in debug flow shows deeper inspection stages.

Answer

Check the traffic log for the session

Answer

Check the session table for the packet

Answer

Run 'diagnose sniffer packet' to capture the packet

Question 12

Which of the following log types on FortiGate records traffic that is denied by a firewall policy?

Accepted Answer

Traffic logs. Traffic logs record both allowed and denied traffic based on firewall policies. Security logs record detection events (antivirus, IPS). Event logs record system events.

Answer

HA logs

Answer

Event logs

Answer

Security logs

Question 13

A FortiGate administrator is troubleshooting an issue where HTTPS traffic is not being properly inspected by the web filter. The policy has SSL inspection enabled. Which TWO commands would provide the most useful real-time debugging information? (Choose two.)

Accepted Answer

diagnose debug flow filter dport 443 ; diagnose debug flow show function-name ; diagnose debug enable. Diagnose debug flow traces the packet through the firewall pipeline, showing each stage. Diagnose sniffer packet captures the actual packets, useful for seeing the SSL handshake. The other options are not real-time for this issue.

Answer

diagnose test application ips 1

Answer

diagnose sys session filter dport 443 ; diagnose sys session list

Answer

execute log display

Question 14

A FortiGate administrator needs to configure an active-passive HA cluster to ensure that management access is available via a dedicated IP address that moves with the active unit. Which THREE configuration steps are required? (Choose three.)

Accepted Answer

Set the management interface under config system ha -> set ha-mgmt-status enable and assign an IP. To provide a floating management IP, the admin must set a dedicated management interface (which can be a physical interface or VLAN), assign an IP to that interface in the HA configuration, and ensure the interface is part of the HA managed interfaces so it synchronizes.

Answer

Configure a dedicated heartbeat interface

Answer

Assign a virtual MAC address to the management interface

Question 15

A FortiGate administrator is investigating a performance issue and suspects that a large number of incomplete TCP connections are consuming session table resources. Which TWO commands would help identify such sessions? (Choose two.)

Accepted Answer

diagnose sys session stat. Diagnose sys session list with filter can show sessions by state. Diagnose sys session stat shows counts by state. The sniffer shows packets, not session state; debug flow is for tracing specific streams.

Answer

diagnose debug flow filter dport 80 ; diagnose debug enable

Answer

diagnose sniffer packet any 'tcp' 4

Answer

diagnose sys session filter proto 6 ; diagnose sys session list