NSE4 High Availability and Diagnostics Practice Test 4 — 15 Questions

Question 1

An administrator is troubleshooting a FortiGate HA cluster that is experiencing frequent failovers. The heartbeat interfaces are configured on port1 and port2. Which diagnostic command should the administrator use to check heartbeat packet loss?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

diagnose sys ha heartbeat. The 'diagnose sys ha heartbeat' command shows heartbeat statistics, including packet loss, sequence numbers, and latency, which helps diagnose heartbeat issues.

Answer

diagnose sys ha status

Answer

get system ha status

Answer

diagnose sys session list

Question 2

Which log severity level indicates that a device is unusable and requires immediate attention?

Accepted Answer

Emergency. FortiGate log severity levels are: Emergency (0), Alert (1), Critical (2), Error (3), Warning (4), Notification (5), Information (6), Debug (7). Emergency is the highest severity, indicating the system is unusable.

Answer

Error

Answer

Critical

Answer

Alert

Question 3

A FortiGate administrator wants to configure ZTNA to secure access to an internal application. Which of the following components is essential for ZTNA to function?

Accepted Answer

FortiClient EMS. ZTNA requires FortiGate to verify the user's identity and device posture. The FortiClient EMS provides device posture information and client certificates, which are essential for ZTNA access control.

Answer

FortiCloud

Answer

FortiAnalyzer

Answer

A VPN tunnel to the client

Question 4

An administrator runs 'diagnose debug flow' for a specific source IP and sees the output includes 'no matching policy'. The FortiGate has a firewall policy that should match the traffic. What is the most likely reason for this message?

Accepted Answer

The firewall policy is disabled or the source/destination interfaces do not match the traffic's ingress/egress interfaces. 'no matching policy' in debug flow indicates that the traffic did not match any firewall policy. Even if a policy exists, it may not match due to incorrect source/destination interfaces, addresses, or other criteria. A common cause is that the traffic is coming from an interface that is not covered by the policy or the policy is disabled.

Answer

The FortiGate's routing table does not have a route for the destination

Answer

The security profiles applied to the policy are blocking the traffic

Answer

The session table is full and cannot accept new sessions

Question 5

A FortiGate cluster in active-passive HA is configured with two heartbeat interfaces. The primary unit fails completely. The secondary unit detects the failure and becomes primary. After the original primary recovers, it remains in passive mode. What is the most likely reason for this behavior?

Accepted Answer

The HA override setting is disabled. When override is disabled (the default), the recovered unit will not preempt the current primary. The cluster stays with the current primary until it fails. This is the expected behavior for graceful recovery.

Answer

The heartbeat interfaces are not properly configured

Answer

The priority of the original primary is lower than the current primary

Answer

The HA override setting is enabled

Question 6

Which FortiGate log type records information about firewall policy matches and traffic statistics?

Accepted Answer

Traffic logs. Traffic logs record information about every session that matches a firewall policy, including source/destination, ports, bytes, and duration. Security logs record IPS, antivirus, web filtering events. Event logs record system events.

Answer

Event logs

Answer

Audit logs

Answer

Security logs

Question 7

An administrator configures a FortiGate to use FortiGuard for web filtering. However, some users report that certain categories are not being blocked as configured. The administrator checks the FortiGuard subscription status and it is valid. What is the most likely cause?

Accepted Answer

The FortiGate cannot reach the FortiGuard distribution servers. Even with a valid subscription, if the FortiGate cannot reach the FortiGuard distribution servers (e.g., due to firewall policies or routing), it will use the local cache. If the cache is outdated or incomplete, filtering may not work as expected.

Answer

The users are bypassing the FortiGate

Answer

The FortiGuard subscription has expired

Answer

The web filter profile is not applied to the firewall policy

Question 8

In an active-active HA cluster, session synchronization is enabled. What is the primary purpose of session synchronization in this mode?

Accepted Answer

To ensure that sessions are not lost if a cluster unit fails. In active-active HA, traffic is distributed across all cluster units. Session synchronization ensures that if a unit fails, other units have the session information to continue processing without interruption. This maintains transparent failover.

Answer

To synchronize firewall policies between cluster members

Answer

To load balance traffic across the cluster

Answer

To reduce the number of sessions on each unit

Question 9

A FortiGate administrator is troubleshooting a traffic issue where users cannot access a specific website. The administrator runs 'diagnose debug flow' and sees the output indicating that traffic is being denied by a firewall policy. Which two actions should the administrator take to identify the specific policy denying the traffic? (Choose two.)

Accepted Answer

Review the policy list and look for the policy ID shown in the debug output. The debug flow output includes the policy ID that denied the traffic. The administrator can check the policy details using 'show firewall policy <id>' or check the traffic log for the session to see which policy was matched.

Answer

Run 'diagnose debug enable' and then reproduce the issue

Answer

Use 'diagnose sys session list' to find the policy ID

Answer

Disable all firewall policies temporarily

Question 10

A FortiGate administrator wants to send logs to both a local disk and a remote FortiCloud account. Which two conditions must be met for this to work? (Choose two.)

Accepted Answer

The FortiGate must have a valid FortiCloud subscription. The FortiGate must have local storage (disk) to store logs locally. It also must have connectivity to FortiCloud servers, and logging to FortiCloud must be enabled. The local disk logging is a separate configuration.

Answer

The FortiGate must be configured to log to both destinations simultaneously

Answer

The FortiGate must be in NAT mode

Answer

The FortiGate must have a policy to allow outbound traffic to FortiCloud

Question 11

A FortiGate HA cluster is running in active-passive mode with two units. The administrator notices that the primary unit fails over to the secondary unit every few minutes, causing service disruption. The heartbeat interfaces are configured on port1 and port2. What is the MOST likely cause of the frequent failovers?

Accepted Answer

The heartbeat interfaces are experiencing high packet loss. High packet loss or jitter on the heartbeat link can cause the secondary unit to believe the primary is down, triggering unnecessary failovers. Heartbeat interfaces must be reliable.

Answer

Session synchronization is consuming too much bandwidth

Answer

The HA priority is set to 0 on the primary unit

Answer

The HA override setting is enabled, causing the secondary to take over

Question 12

You run 'diagnose sys session filter dport 443' and see the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate about the session?

Accepted Answer

The session is initiating a TCP connection and has not yet completed the handshake. proto_state=01 means TCP SYN_SENT state, meaning the three-way handshake is incomplete. The session is still establishing.

Answer

The session has expired and will be removed in 1 second

Answer

The session is closing and has 3599 seconds until the entry is removed

Answer

The session is fully established and has been active for 3600 seconds

Question 13

A FortiGate administrator needs to capture packets on the DMZ interface to troubleshoot a connectivity issue. Which CLI command should be used to start a packet capture?

Accepted Answer

diagnose sniffer packet. The command 'diagnose sniffer packet' is used for packet capture on FortiGate interfaces.

Answer

diagnose debug flow

Answer

diagnose sys session list

Answer

execute packet-capture start

Question 14

An administrator configures a FortiGate HA cluster in active-active mode. After enabling session synchronization, they notice that new sessions are not being synced to the secondary unit. The cluster is using a dedicated heartbeat interface. What could be the reason?

Accepted Answer

The firewall policy does not have session sync enabled. In active-active HA, session synchronization requires that the session sync flag is enabled on the firewall policy. Without it, sessions are not synced.

Answer

The HA mode is set to active-passive

Answer

The session TTL is too short

Answer

The heartbeat interface is not configured with an IP address

Question 15

What is the purpose of the 'override' setting in FortiGate HA?

Accepted Answer

It enables the higher-priority unit to reclaim the primary role after recovery. HA override allows a device with higher priority to take over as primary after it recovers from a failure.

Answer

It allows management access to the cluster via a virtual IP

Answer

It disables HA failover during maintenance windows

Answer

It forces the secondary unit to become primary immediately