NSE4 High Availability and Diagnostics Practice Test 3 — 15 Questions

Question 1

An organization wants to send FortiGate logs to a central log management system for long-term storage and compliance. Which FortiGate feature is specifically designed for collecting and analyzing logs from multiple FortiGate devices?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

FortiAnalyzer. FortiAnalyzer is the central log management and analysis platform for Fortinet devices. It aggregates logs, generates reports, and provides long-term storage.

Answer

Disk logging

Answer

FortiGuard

Answer

FortiCloud

Question 2

A FortiGate administrator wants to see real-time debugging output for traffic matching a specific source IP address. Which command sequence would achieve this?

Accepted Answer

diagnose debug flow filter src 10.0.1.10 ; diagnose debug flow show function-name ; diagnose debug enable. The 'diagnose debug flow' command sequence is specifically designed for real-time debugging of traffic flows, allowing filtering by source IP with the 'filter src' option. Enabling debug output with 'diagnose debug enable' then shows flow trace information for packets matching the filter, which is the standard method for live traffic debugging on FortiGate.

Answer

diagnose sys session filter src 10.0.1.10 ; diagnose sys session list

Answer

diagnose sniffer packet any 'host 10.0.1.10' 4

Answer

diagnose debug reset ; diagnose debug enable ; diagnose debug flow show iprope

Question 3

A FortiGate administrator has configured an active-passive HA cluster. After a failover event, the former primary unit comes back online and immediately takes over as primary again, causing another failover. The administrator wants the original primary to stay in standby until the current primary fails. Which setting should be configured?

Accepted Answer

Disable HA override on both units. HA override (set ha-override enable) causes a device to resume primary role when it becomes available with higher priority. Disabling override prevents this preemptive behavior.

Answer

Enable HA override on both units

Answer

Set the HA mode to active-active

Answer

Increase the HA priority on the primary unit

Question 4

Which FortiGate log severity level indicates that a system is unusable and requires immediate attention?

Accepted Answer

Emergency. Emergency is the highest severity level in syslog/FortiGate, indicating a system is unusable. Critical indicates critical conditions but not necessarily unusable.

Answer

Error

Answer

Critical

Answer

Alert

Question 5

A FortiGate administrator needs to ensure that traffic logs are sent to a FortiAnalyzer even when the FortiGate's local disk is full. What configuration is required?

Accepted Answer

Enable 'remote log' under Log Settings and specify the FortiAnalyzer IP. Configuring the FortiAnalyzer as a log destination ensures logs are sent immediately. The local disk issue does not affect remote logging. Optionally, the admin can set logging to 'fallback' or 'any', but the direct method is to configure the remote syslog/FortiAnalyzer.

Answer

Enable 'disk logging' with rollover policy

Answer

Increase the log severity to 'emergency' only

Answer

Configure a log filter to send only security logs

Question 6

A FortiGate administrator notices that after upgrading the firmware, the HA cluster fails to form. Both units show the correct HA configuration. What is the most likely cause?

Accepted Answer

The firmware versions are different on the two units. HA clusters require all members to run the same firmware version. Mismatched firmware prevent cluster formation.

Answer

The HA heartbeat interfaces are not connected

Answer

The HA mode is set to active-active on one unit and active-passive on the other

Answer

The HA priority values are identical

Question 7

A FortiGate administrator runs 'diagnose debug flow' and sees the output 'FW-6: packet is allowed by policy' but the packet is still dropped. What additional debug information should the administrator check to determine why the packet is dropped after being allowed?

Accepted Answer

Enable 'diagnose debug flow show function-name' to see more detailed stages. After policy lookup, further processing like security profiles, NAT, or routing may drop the packet. The 'function-name' parameter in debug flow shows deeper inspection stages.

Answer

Check the traffic log for the session

Answer

Check the session table for the packet

Answer

Run 'diagnose sniffer packet' to capture the packet

Question 8

Which of the following log types on FortiGate records traffic that is denied by a firewall policy?

Accepted Answer

Traffic logs. Traffic logs record both allowed and denied traffic based on firewall policies. Security logs record detection events (antivirus, IPS). Event logs record system events.

Answer

HA logs

Answer

Event logs

Answer

Security logs

Question 9

A FortiGate administrator is troubleshooting an issue where HTTPS traffic is not being properly inspected by the web filter. The policy has SSL inspection enabled. Which TWO commands would provide the most useful real-time debugging information? (Choose two.)

Accepted Answer

diagnose debug flow filter dport 443 ; diagnose debug flow show function-name ; diagnose debug enable. Diagnose debug flow traces the packet through the firewall pipeline, showing each stage. Diagnose sniffer packet captures the actual packets, useful for seeing the SSL handshake. The other options are not real-time for this issue.

Answer

diagnose test application ips 1

Answer

diagnose sys session filter dport 443 ; diagnose sys session list

Answer

execute log display

Question 10

A FortiGate administrator needs to configure an active-passive HA cluster to ensure that management access is available via a dedicated IP address that moves with the active unit. Which THREE configuration steps are required? (Choose three.)

Accepted Answer

Set the management interface under config system ha -> set ha-mgmt-status enable and assign an IP. To provide a floating management IP, the admin must set a dedicated management interface (which can be a physical interface or VLAN), assign an IP to that interface in the HA configuration, and ensure the interface is part of the HA managed interfaces so it synchronizes.

Answer

Configure a dedicated heartbeat interface

Answer

Assign a virtual MAC address to the management interface

Question 11

A FortiGate administrator is investigating a performance issue and suspects that a large number of incomplete TCP connections are consuming session table resources. Which TWO commands would help identify such sessions? (Choose two.)

Accepted Answer

diagnose sys session stat. Diagnose sys session list with filter can show sessions by state. Diagnose sys session stat shows counts by state. The sniffer shows packets, not session state; debug flow is for tracing specific streams.

Answer

diagnose debug flow filter dport 80 ; diagnose debug enable

Answer

diagnose sniffer packet any 'tcp' 4

Answer

diagnose sys session filter proto 6 ; diagnose sys session list

Question 12

A network administrator is troubleshooting a FortiGate HA cluster that is not failing over as expected. The cluster consists of two units in active-passive mode. The administrator issues the command 'diagnose sys ha status' and sees that both units have the same priority. What is the most likely cause of the failover issue?

Accepted Answer

The HA heartbeat interfaces are not properly connected. In FortiGate active-passive HA, failover relies on heartbeat connectivity between cluster units. The 'diagnose sys ha status' command showing both units with the same priority does not necessarily indicate a problem; however, if heartbeat interfaces are not properly connected or configured, the units cannot detect each other's status or failure. This prevents failover from occurring when the primary unit fails, as the backup unit does not realize the primary is down. The override setting (option A) only controls preemption after recovery, not initial failover on failure. With equal priorities, failover would still occur if heartbeat communication is intact.

Answer

The HA override setting is disabled

Answer

The HA mode is set to active-active instead of active-passive

Answer

The session pickup feature is enabled

Question 13

A FortiGate administrator needs to capture packets on interface port2 for 10 seconds to diagnose a connectivity issue. Which command should the administrator use?

Accepted Answer

diagnose sniffer packet port2 '' 4 10. The 'diagnose sniffer packet' command is used to capture packets on a FortiGate. The syntax 'diagnose sniffer packet port2 "" 4 10' captures packets on interface port2 for 10 seconds with verbose output (level 4). The empty filter '' captures all traffic.

Answer

diagnose sys session list port2 10

Answer

diagnose debug flow port2 10

Answer

execute sniffer port2 10

Question 14

You run 'diagnose sys session filter dport 443' and see the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate about the session?

Accepted Answer

The session is in the TCP SYN sent state, not yet fully established. The output shows a TCP session (proto=6) in state 01 (TCP SYN sent), duration 3600 seconds, and expire 3599 seconds. This indicates the session is in the initial SYN state and has not completed the three-way handshake.

Answer

The session is using UDP protocol

Answer

The session has expired and is being removed

Answer

The session has completed the three-way handshake and is established

Question 15

A FortiGate administrator needs to forward logs to a FortiAnalyzer for centralized management. The FortiAnalyzer is reachable at 10.0.1.100. Which configuration step is required on the FortiGate to send logs to this FortiAnalyzer?

Accepted Answer

Configure the FortiAnalyzer in System > FortiAnalyzer. To send logs to FortiAnalyzer, the administrator must configure the FortiAnalyzer server under System > FortiAnalyzer or via CLI using 'config log fortianalyzer setting set server 10.0.1.100'. The log forwarding policy is not used for FortiAnalyzer.

Answer

Configure a syslog server under Log Setting

Answer

Add a firewall policy allowing traffic from FortiGate to FortiAnalyzer

Answer

Enable logging to FortiCloud instead