NSE4 High Availability and Diagnostics Practice Test 4 — 15 Questions

Question 1

An administrator configures a FortiGate HA cluster in active-passive mode. After a failover, some UDP-based sessions are lost. What is the MOST likely reason?

Accepted Answer

UDP session synchronization is not enabled by default. UDP is stateless and not synchronized by default in active-passive HA unless session synchronization is configured. TCP sessions are synchronized by default.

Answer

The heartbeat interface failed

Answer

The failover triggered a routing table change

Answer

The HA priority was set too low on the backup unit

Question 2

An administrator wants to capture HTTP traffic on port1 for troubleshooting. Which CLI command should be used?

Accepted Answer

diagnose sniffer packet port1 'tcp port 80'. The command `diagnose sniffer packet port1 'tcp port 80'` captures packets on interface port1 with a filter for TCP port 80 (HTTP). This is the correct syntax for packet capture on FortiGate, allowing the administrator to see the actual HTTP traffic for troubleshooting.

Answer

diagnose debug flow

Answer

execute sniffer packet

Answer

diagnose sys session filter

Question 3

An administrator runs 'diagnose debug flow' and sees the output 'no matching policy'. What does this indicate?

Accepted Answer

There is no firewall policy that allows the traffic from the source to the destination. The debug flow trace shows packets flowing through the firewall policy evaluation. 'No matching policy' means the packet did not match any firewall policy.

Answer

The packet is being processed by a policy with the correct source/destination

Answer

The packet was dropped due to an antivirus signature match

Answer

The packet is being routed through a blackhole route

Question 4

Which FortiGate feature allows users to access internal applications without a VPN client?

Accepted Answer

ZTNA. ZTNA (Zero Trust Network Access) on FortiGate allows users to access internal applications without a traditional VPN client by providing application-level, identity-based access. Unlike IPsec or SSL VPN, which establish network-level tunnels, ZTNA grants access to specific applications based on user identity and device posture, often through a lightweight agent or clientless browser access. This makes it the correct answer for clientless internal application access.

Answer

IPsec VPN

Answer

SSL VPN

Answer

FortiGuard

Question 5

An administrator notices that the FortiGate is not receiving updates from FortiGuard. The DNS settings are correct and the FortiGate can ping update.fortiguard.net. What is the MOST likely cause?

Accepted Answer

The FortiGuard subscription has expired. The most likely cause for a FortiGate not receiving updates from FortiGuard, given that DNS is correct and the FortiGate can ping update.fortiguard.net, is that the FortiGuard subscription has expired. Without a valid subscription, the FortiGate cannot download updates even if network connectivity is fine. Other causes like firewall policy blocking HTTPS or antivirus profile blocking traffic would typically prevent ping or DNS resolution, but those are working.

Answer

The firewall policy blocks outbound HTTPS

Answer

The antivirus profile is blocking the update traffic

Answer

The update server IP address changed

Question 6

A FortiGate administrator is configuring an active-passive HA cluster and wants to ensure that the cluster can properly detect a failure of the primary unit. The administrator has configured two heartbeat interfaces, port3 and port4. Which two statements about HA heartbeat interfaces are correct? (Choose two.)

Accepted Answer

If multiple heartbeat interfaces are configured, the cluster will use all of them simultaneously for heartbeat and session synchronization.. The correct statements are that with multiple heartbeat interfaces, the cluster uses all of them simultaneously for heartbeat and session synchronization, and that session synchronization traffic can be separated using the 'session-sync-dev' option. These features enhance HA reliability and performance by providing redundancy and traffic isolation.

Answer

Only one heartbeat interface can be configured in an active-passive cluster.

Answer

Heartbeat interfaces must be connected directly between cluster members and cannot be used for regular network traffic.

Answer

The heartbeat interfaces must be on the same subnet for the cluster to communicate.

Question 7

An administrator manages a FortiGate 600E active-passive HA cluster. The primary unit's flash disk fails, causing it to reboot. After the reboot, the primary unit comes back online but remains in a subordinate role. The administrator wants to force this unit to become the primary again without disrupting traffic. Which command should the administrator use?

Accepted Answer

diagnose sys ha reset-uptime. In an active-passive HA cluster, the primary unit is typically selected based on the highest HA priority and, if priorities are equal, the longest uptime. After a reboot, the unit's uptime is reset, making it less likely to become primary. Resetting the HA uptime counter with 'diagnose sys ha reset-uptime' forces the cluster to re-evaluate and can restore the unit to the primary role without service interruption. Other commands manage sessions or checksums, not role election.

Answer

diagnose sys ha checksum recalculate

Answer

execute ha synchronize

Answer

execute ha manage 0

Question 8

A network administrator is troubleshooting an HA cluster and wants to verify the current HA status, including which unit is primary and the cluster uptime. Which command should the administrator use?

Accepted Answer

get system ha status. To verify HA status, including the primary unit and cluster uptime, the administrator should use 'get system ha status'. This command provides a summary of the HA cluster's operational state, including roles, synchronization, and uptime. The other options are either invalid commands or display configuration rather than runtime status, making them unsuitable for troubleshooting HA health.

Answer

show system ha

Answer

diagnose sys ha status

Answer

execute ha status

Question 9

An administrator is configuring HA on two FortiGate devices. The cluster must support failover if the primary unit's WAN interface goes down, but the administrator wants to avoid unnecessary failovers due to flapping. Which HA setting should be configured on the primary unit's WAN interface?

Accepted Answer

Configure the interface as a monitored interface and set the failover hold-down time in the HA configuration.. The cluster must fail over when the WAN interface fails, but to prevent flapping, the interface should be monitored and the failover hold-down time should be configured. The hold-down time delays failover until the interface has been down for a specified period, avoiding unnecessary role changes due to transient issues. Monitoring the interface ensures that its status is checked, and the hold-down time adds stability.

Answer

Enable failover hold-down time on the interface.

Answer

Set the interface as a monitored interface with a failover threshold.

Answer

Set the interface's link-failure threshold to zero to disable failover on that interface.

Question 10

A FortiGate administrator is troubleshooting an HA cluster that is experiencing frequent failovers. The administrator suspects that the heartbeat interface is dropping packets. Which command can be used to view HA heartbeat packet statistics?

Accepted Answer

diagnose sys ha dump. To view HA heartbeat packet statistics, the administrator should use 'diagnose sys ha dump'. This command displays detailed HA statistics, including heartbeat packets sent and received, errors, and interface information. It is the appropriate tool for diagnosing heartbeat-related issues that may cause frequent failovers. Other options are invalid commands or do not provide the required statistics.

Answer

diagnose sys ha heartbeat

Answer

execute ha heartbeat-statistics

Answer

get system ha stats

Question 11

A network engineer is configuring an SD-WAN rule to steer voice traffic to the MPLS link with the lowest latency. The SLA target is set to latency < 50 ms and jitter < 10 ms. However, the MPLS link occasionally exceeds the latency threshold. What should the engineer do to ensure voice traffic uses the best available link without manual intervention?

Accepted Answer

Configure the SD-WAN rule with a secondary strategy to use the broadband link when SLA is not met.. Configuring a secondary strategy (e.g., fallback to broadband) allows the SD-WAN rule to automatically steer voice traffic to the best available link when the primary MPLS link fails the SLA (latency > 50 ms). This ensures continuous SLA compliance without manual intervention, leveraging Fortinet's SD-WAN dynamic path selection based on real-time performance metrics.

Answer

Remove the latency performance SLA and rely only on jitter.

Answer

Increase the jitter threshold to 15 ms to avoid SLA violations.

Answer

Disable SLA enforcement on the SD-WAN rule so voice traffic always uses the MPLS link.

Question 12

A company has two remote sites connected via an SD-WAN overlay. The headquarters uses a FortiGate with two WAN links: Fiber (priority 1) and LTE (priority 2). The SD-WAN rule for business-critical traffic uses the 'best quality' strategy with SLA targets for latency and jitter. The fiber link occasionally experiences high jitter but low latency. The engineer notices that traffic is not failing over to LTE even when jitter exceeds the threshold. What is the most likely reason?

Accepted Answer

The performance SLA for jitter is not configured, only latency.. The SD-WAN rule uses the 'best quality' strategy, which selects the best link based on configured SLA metrics. If only latency is configured in the performance SLA, jitter exceeding the threshold will not trigger a failover, as the SLA only evaluates the configured metrics. The fiber link may still meet the latency SLA, so traffic remains on it despite high jitter.

Answer

The SD-WAN rule has SLA match set to 'either' instead of 'all'.

Answer

The LTE link has a higher cost and is not considered for failover.

Answer

The fiber link has a higher interface weight.

Question 13

In an active-active HA cluster, which of the following must be identical on both FortiGate units?

Accepted Answer

Virtual cluster ID. In an active-active HA cluster, the virtual cluster ID must be identical on both FortiGate units because it defines the cluster group and ensures that only units with the same ID can form an HA cluster. This ID is used in heartbeat packets to verify cluster membership and prevent accidental merging of separate clusters. Without a matching virtual cluster ID, the units will not recognize each other as part of the same HA group.

Answer

HA priority

Answer

Management IP address

Answer

Hostname

Question 14

Which TWO statements about FortiGate HA heartbeat interfaces are correct?

Accepted Answer

Heartbeat interfaces must be on the same subnet.. FortiGate HA heartbeat interfaces must be on the same subnet to allow the heartbeat packets (typically UDP port 496) to be exchanged directly between the primary and secondary units. This ensures Layer 2 adjacency is maintained for reliable failure detection and synchronization.

Answer

Heartbeat interfaces must be in the same VDOM.

Answer

Heartbeat interfaces must be dedicated management ports.

Answer

Only two heartbeat interfaces can be configured.

Question 15

Which THREE statements about SD-WAN rules are correct?

Accepted Answer

SD-WAN rules are evaluated in order of priority.. SD-WAN rules are evaluated in order of priority, meaning the rule with the highest priority (lowest number) is matched first. This sequential evaluation ensures deterministic traffic steering based on the most specific match criteria defined by the administrator.

Answer

SD-WAN rules must use a 'load balancing' strategy.

Answer

Each SD-WAN rule can only contain one member.