NSE4 High Availability and Diagnostics Practice Test 3 — 15 Questions

Question 1

An administrator is setting up an active-passive HA pair and wants to ensure that the cluster can properly monitor each unit's health. Which TWO interfaces must be configured as HA heartbeat interfaces? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A VLAN interface on a dedicated trunk that is only used for HA. Option B is correct because a VLAN interface on a dedicated trunk reserved exclusively for HA provides an isolated Layer 2 path for heartbeat traffic, preventing data-plane congestion or failures from disrupting health monitoring between the HA peers. Option C is correct because a dedicated physical interface not used for data traffic guarantees the heartbeat link has its own bandwidth and is not affected by production traffic or data interface failures, which is the recommended design for active-passive HA heartbeat connectivity. Options A, D, and E are not appropriate because the internal switch interface, WAN interface, and management interface typically carry data, internet, or administrative traffic, so using them for heartbeats risks heartbeat loss during traffic saturation or link failure and does not provide the required isolation for reliable HA health monitoring.

Answer

The internal switch interface (e.g., port3)

Answer

The WAN interface (port1)

Answer

The management interface

Question 2

A FortiGate administrator is configuring logging to meet a compliance requirement that all security events must be stored for at least one year. The FortiGate has limited local disk space. Which THREE actions should the administrator take to meet this requirement? (Choose three.)

Accepted Answer

Configure log rolling and retention policies to automatically delete older logs from the local disk after a set period. Option B is correct because configuring log rolling and retention policies lets the FortiGate manage limited local disk space by automatically deleting or archiving older logs after a defined period, preventing the disk from filling while keeping recent logs available locally. Option D is correct because sending logs to a FortiAnalyzer offloads long-term storage from the FortiGate's limited local disk and provides centralized, scalable retention suitable for a one-year compliance requirement. Option E is correct because FortiCloud logging provides cloud-based storage that preserves events beyond the FortiGate's local capacity, satisfying the one-year retention mandate without relying on local disk. Option A is not appropriate because filtering to only 'emergency' severity would discard most security events, violating the requirement that all security events be stored. Option C is not appropriate because disabling local disk logging alone does not provide any retention mechanism and would remove local log availability without meeting the one-year storage requirement.

Answer

Set the log severity filter to only log 'emergency' events to reduce volume

Answer

Disable local disk logging to save space

Question 3

A FortiGate administrator runs 'diagnose debug flow' with a filter for a specific source IP. The output shows 'no policy matched' for the traffic. The administrator verifies that a firewall policy exists with that source IP. What is the most likely reason for the 'no policy matched' message?

Accepted Answer

The traffic is being blocked by an implicit deny or a different policy before reaching the expected policy. Debug flow may show 'no policy matched' when traffic hits an implicit deny or a different policy before reaching the expected policy, such as due to policy order where an earlier policy with a broader match blocks it, or inter-VDOM routing issues. Option B is incorrect because the debug flow filter is working correctly—it matches the source IP; the issue is that no applicable policy is found for that traffic.

Answer

The firewall policy is disabled

Answer

The debug flow filter is not configured correctly

Answer

The source IP is not in the routing table

Question 4

A FortiGate HA cluster is set to active-active mode. The administrator notices that session synchronization is enabled but some sessions are not being synced between cluster units. Which of the following is a likely cause for incomplete session synchronization in active-active mode?

Accepted Answer

The 'set session-sync-id' is not configured or mismatched between cluster units. In FortiGate active-active HA, session synchronization between cluster units is scoped by the session-sync-id (also called the session pickup group). If the session-sync-id is not configured or is mismatched across cluster members, sessions are only synced within the same sync group, so many sessions never propagate to peer units. This directly causes incomplete session synchronization even though 'session synchronization' is globally enabled.

Answer

The cluster is using unicast heartbeat

Answer

The heartbeat interface speed is set to 1 Gbps

Answer

The HA override is enabled

Question 5

An administrator is reviewing log files on a FortiGate and needs to identify events related to a specific user authentication failure. The FortiGate has local disk logging enabled. Which command would the administrator use to search the logs for this event?

Accepted Answer

execute log filter. The 'execute log filter' command is used to filter log messages based on various criteria, such as user authentication failures. It allows the administrator to search logs for specific events.

Answer

diagnose debug authd fsrv record

Answer

show log traffic-log

Answer

get log traffic

Question 6

A FortiGate administrator is troubleshooting an issue where internal users cannot access a public web server. The administrator runs 'diagnose debug flow' and sees the output shows 'forward to port2' but then 'no route to host'. What is the most likely cause?

Accepted Answer

The FortiGate does not have a route to the destination IP. The debug flow output shows 'forward to port2' but then 'no route to host'. This indicates that the packet is being forwarded to the correct outgoing interface (port2) but the FortiGate does not have a route to the destination IP address in its routing table, so the packet cannot be forwarded further. Therefore, the most likely cause is that the FortiGate lacks a route to the destination IP, which corresponds to Option C.

Answer

The source IP is not in the routing table

Answer

The interface port2 is down

Answer

The destination port is blocked by a firewall policy

Question 7

Which log severity level indicates that a log message is for informational purposes and does not require immediate action?

Accepted Answer

Information. The Information severity level (often level 6 in syslog) is used for normal operational messages that confirm routine system activities. These messages are purely informational and do not indicate any error or condition requiring attention. In FortiGate logging, Information level logs are generated for events like administrative logins, configuration changes, or successful VPN connections, and they are not considered urgent.

Answer

Notice

Answer

Debug

Answer

Warning

Question 8

A FortiGate administrator is configuring ZTNA (Zero Trust Network Access) to secure access to an internal application. Which two components must be configured to create a ZTNA rule? (Choose two.)

Accepted Answer

ZTNA gateway. Option B (ZTNA gateway) is correct because the ZTNA gateway (configured as a ZTNA server/access proxy on the FortiGate) is the enforcement point that proxies and inspects client traffic to the protected application, and it must exist before a ZTNA rule can reference it. Option D (ZTNA application) is correct because the ZTNA rule must specify the protected application (the real server/application object published through the ZTNA gateway) that clients are allowed to reach. Together, the ZTNA gateway and ZTNA application are the two required building blocks referenced by a ZTNA firewall rule. Option A (ZTNA tag) is not required to create the rule itself; tags are used for dynamic client/device posture grouping and are optional unless you want tag-based matching. Option C (VPN tunnel) is incorrect because ZTNA is designed as a client-based, per-application access model that does not require an IPsec or SSL VPN tunnel. Option E (SSL certificate) is incorrect because, while certificates may be used for authentication or the gateway's TLS service, a certificate is not a mandatory component that defines a ZTNA rule.

Answer

ZTNA tag

Answer

VPN tunnel

Answer

SSL certificate

Question 9

In a FortiGate HA cluster, the administrator wants to reduce failover time when the primary unit fails. Which two adjustments can help achieve this? (Choose two.)

Accepted Answer

Decrease the 'set ha-heartbeat-interval' value. Option A is correct because lowering the 'set ha-heartbeat-interval' value makes the FortiGate send HA heartbeat packets more frequently, so a missed heartbeat is detected sooner and the cluster can trigger a failover more quickly. Option D is correct because decreasing the 'set ha-failover-threshold' value reduces the number of consecutive missed heartbeats required before the standby declares the primary failed, which shortens the detection time and thus the failover time. Option B is incorrect because 'set session-pickup-delay' controls how long the new primary waits before picking up sessions, and increasing it would delay session continuity rather than speed up failover. Option C is incorrect because 'set ha-arp-interval' relates to gratuitous ARP behavior for updating network devices, not to the heartbeat-based failure detection mechanism. Option E is incorrect because increasing the 'set ha-heartbeat-interval' value makes heartbeats less frequent, which would slow failure detection and lengthen failover time.

Answer

Increase the 'set session-pickup-delay' value

Answer

Enable 'set ha-arp-interval'

Answer

Increase the 'set ha-heartbeat-interval' value

Question 10

A FortiGate administrator is troubleshooting a VPN tunnel that is not establishing. The administrator wants to view the IKE debug output in real time. Which command should they use?

Accepted Answer

diagnose debug application ike -1. The command `diagnose debug application ike -1` enables real-time IKE debug output on a FortiGate. The `-1` sets the debug level to verbose, showing detailed IKE negotiation messages, which is essential for troubleshooting VPN tunnel establishment issues.

Answer

diagnose debug flow filter dport 500

Answer

diagnose sniffer packet any "udp port 500"

Answer

diagnose debug application ipsec -1

Question 11

A FortiGate administrator is setting up an HA cluster with two FortiGates. The heartbeat interfaces are connected via a dedicated switch. The administrator wants to ensure that the management IP is always accessible through the active unit. Which configuration is required?

Accepted Answer

Configure 'set management-ip' under the HA interface configuration. In a FortiGate HA cluster, the management IP is a dedicated IP address that is always reachable on the active unit, regardless of which physical device is active. This is configured using the command 'set management-ip' under the HA interface configuration (config system ha). This allows administrators to connect to the cluster via a consistent IP address for management purposes, even after a failover. The management IP is separate from the individual unit's management IPs and is only active on the primary unit.

Answer

Configure a virtual IP address for the management interface

Answer

Set the management IP on each unit separately

Answer

Use the same IP address on both units

Question 12

An administrator needs to store logs for compliance purposes and wants them to be retained even if the FortiGate is reset. Which log storage option should they use?

Accepted Answer

FortiAnalyzer. FortiAnalyzer provides centralized log storage separate from the FortiGate, ensuring logs are retained even if the FortiGate is reset.

Answer

FortiCloud logs

Answer

Syslog server

Answer

Local disk logs

Question 13

In an active-passive HA cluster, the administrator wants to ensure that new connections are load-balanced across both units only for specific services while maintaining failover capability. Which configuration should be applied?

Accepted Answer

Change HA mode to active-active. FortiGate HA active-active mode distributes new sessions across both cluster units while still providing failover if one unit fails, which matches the requirement to load-balance specific services yet retain HA. Active-passive only uses the secondary for failover, so it cannot load-balance. Switching the HA mode to active-active is the correct configuration change.

Answer

Set 'set ha-priority' to 100 on both units

Answer

Configure virtual IPs for each service

Answer

Enable 'set load-balance-schedule' on the HA interface

Question 14

An administrator wants to ensure that log messages are categorized by severity and that only events with severity 'error' and above are sent to the syslog server. Which configuration should be used?

Accepted Answer

Set 'set severity error' in syslog config. In FortiGate syslog configuration, the 'set severity' parameter defines the minimum severity level that will be forwarded; setting it to 'error' means error, critical, alert, and emergency messages are sent, while warning, notification, information, and debug are suppressed. This matches the requirement to send only 'error and above.' The severity levels follow the syslog RFC 5424 ordering, so choosing the correct threshold is a matter of knowing that ordering.

Answer

Set 'set severity critical' in syslog config

Answer

Set 'set severity warning' in syslog config

Answer

Set 'set severity alert' in syslog config

Question 15

An administrator is troubleshooting a FortiGate that is not sending logs to FortiAnalyzer. The FortiAnalyzer is reachable from the FortiGate. Which command should the administrator use to test the connectivity and log forwarding?

Accepted Answer

execute log fortianalyzer test. The command `execute log fortianalyzer test` is specifically designed to verify log forwarding connectivity to FortiAnalyzer. It sends a test log entry to the configured FortiAnalyzer and reports whether the transmission succeeded, directly addressing the troubleshooting scenario. This command validates the entire log pipeline, including network reachability, authentication, and log reception, making it the correct tool for this task.

Answer

execute log send

Answer

ping <FortiAnalyzer IP>

Answer

diagnose debug application fortianalyzer