NSE4 High Availability and Diagnostics Practice Test 4 — 15 Questions

Question 1

A network administrator is troubleshooting a FortiGate HA cluster that is not failing over as expected. The cluster consists of two units in active-passive mode. The administrator issues the command 'diagnose sys ha status' and sees that both units have the same priority. What is the most likely cause of the failover issue?

Accepted Answer

The HA override setting is disabled. In active-passive HA, the unit with the higher priority (lower number) becomes primary. If priorities are equal, the primary is determined by serial number. Equal priorities do not prevent failover; the issue is likely that the override setting is disabled, so a lower-priority unit cannot take over even if the primary fails unless override is enabled.

Answer

The HA mode is set to active-active instead of active-passive

Answer

The session pickup feature is enabled

Answer

The HA heartbeat interfaces are not properly connected

Question 2

A FortiGate administrator needs to capture packets on interface port2 for 10 seconds to diagnose a connectivity issue. Which command should the administrator use?

Accepted Answer

diagnose sniffer packet port2 '' 4 10. The 'diagnose sniffer packet' command is used to capture packets on a FortiGate. The syntax 'diagnose sniffer packet any "" 4 10' captures on all interfaces for 10 seconds with verbose output.

Answer

diagnose sys session list port2 10

Answer

diagnose debug flow port2 10

Answer

execute sniffer port2 10

Question 3

You run 'diagnose sys session filter dport 443' and see the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate about the session?

Accepted Answer

The session is in the TCP SYN sent state, not yet fully established. The output shows a TCP session (proto=6) in state 01 (TCP SYN sent), duration 3600 seconds, and expire 3599 seconds. This indicates the session is in the initial SYN state and has not completed the three-way handshake.

Answer

The session is using UDP protocol

Answer

The session has expired and is being removed

Answer

The session has completed the three-way handshake and is established

Question 4

A FortiGate administrator needs to forward logs to a FortiAnalyzer for centralized management. The FortiAnalyzer is reachable at 10.0.1.100. Which configuration step is required on the FortiGate to send logs to this FortiAnalyzer?

Accepted Answer

Configure the FortiAnalyzer in System > FortiAnalyzer. To send logs to FortiAnalyzer, the administrator must configure the FortiAnalyzer server under System > FortiAnalyzer or via CLI using 'config log fortianalyzer setting set server 10.0.1.100'. The log forwarding policy is not used for FortiAnalyzer.

Answer

Configure a syslog server under Log Setting

Answer

Add a firewall policy allowing traffic from FortiGate to FortiAnalyzer

Answer

Enable logging to FortiCloud instead

Question 5

An administrator is troubleshooting a FortiGate HA cluster that is experiencing frequent failovers. The heartbeat interfaces are configured on port1 and port2. Which diagnostic command should the administrator use to check heartbeat packet loss?

Accepted Answer

diagnose sys ha heartbeat. The 'diagnose sys ha heartbeat' command shows heartbeat statistics, including packet loss, sequence numbers, and latency, which helps diagnose heartbeat issues.

Answer

diagnose sys ha status

Answer

get system ha status

Answer

diagnose sys session list

Question 6

Which log severity level indicates that a device is unusable and requires immediate attention?

Accepted Answer

Emergency. FortiGate log severity levels are: Emergency (0), Alert (1), Critical (2), Error (3), Warning (4), Notification (5), Information (6), Debug (7). Emergency is the highest severity, indicating the system is unusable.

Answer

Error

Answer

Critical

Answer

Alert

Question 7

A FortiGate administrator wants to configure ZTNA to secure access to an internal application. Which of the following components is essential for ZTNA to function?

Accepted Answer

FortiClient EMS. ZTNA requires FortiGate to verify the user's identity and device posture. The FortiClient EMS provides device posture information and client certificates, which are essential for ZTNA access control.

Answer

FortiCloud

Answer

FortiAnalyzer

Answer

A VPN tunnel to the client

Question 8

An administrator runs 'diagnose debug flow' for a specific source IP and sees the output includes 'no matching policy'. The FortiGate has a firewall policy that should match the traffic. What is the most likely reason for this message?

Accepted Answer

The firewall policy is disabled or the source/destination interfaces do not match the traffic's ingress/egress interfaces. 'no matching policy' in debug flow indicates that the traffic did not match any firewall policy. Even if a policy exists, it may not match due to incorrect source/destination interfaces, addresses, or other criteria. A common cause is that the traffic is coming from an interface that is not covered by the policy or the policy is disabled.

Answer

The FortiGate's routing table does not have a route for the destination

Answer

The security profiles applied to the policy are blocking the traffic

Answer

The session table is full and cannot accept new sessions

Question 9

A FortiGate cluster in active-passive HA is configured with two heartbeat interfaces. The primary unit fails completely. The secondary unit detects the failure and becomes primary. After the original primary recovers, it remains in passive mode. What is the most likely reason for this behavior?

Accepted Answer

The HA override setting is disabled. When override is disabled (the default), the recovered unit will not preempt the current primary. The cluster stays with the current primary until it fails. This is the expected behavior for graceful recovery.

Answer

The heartbeat interfaces are not properly configured

Answer

The priority of the original primary is lower than the current primary

Answer

The HA override setting is enabled

Question 10

Which FortiGate log type records information about firewall policy matches and traffic statistics?

Accepted Answer

Traffic logs. Traffic logs record information about every session that matches a firewall policy, including source/destination, ports, bytes, and duration. Security logs record IPS, antivirus, web filtering events. Event logs record system events.

Answer

Event logs

Answer

Audit logs

Answer

Security logs

Question 11

An administrator configures a FortiGate to use FortiGuard for web filtering. However, some users report that certain categories are not being blocked as configured. The administrator checks the FortiGuard subscription status and it is valid. What is the most likely cause?

Accepted Answer

The FortiGate cannot reach the FortiGuard distribution servers. Even with a valid subscription, if the FortiGate cannot reach the FortiGuard distribution servers (e.g., due to firewall policies or routing), it will use the local cache. If the cache is outdated or incomplete, filtering may not work as expected.

Answer

The users are bypassing the FortiGate

Answer

The FortiGuard subscription has expired

Answer

The web filter profile is not applied to the firewall policy

Question 12

In an active-active HA cluster, session synchronization is enabled. What is the primary purpose of session synchronization in this mode?

Accepted Answer

To ensure that sessions are not lost if a cluster unit fails. In active-active HA, traffic is distributed across all cluster units. Session synchronization ensures that if a unit fails, other units have the session information to continue processing without interruption. This maintains transparent failover.

Answer

To synchronize firewall policies between cluster members

Answer

To load balance traffic across the cluster

Answer

To reduce the number of sessions on each unit

Question 13

A FortiGate administrator is troubleshooting a traffic issue where users cannot access a specific website. The administrator runs 'diagnose debug flow' and sees the output indicating that traffic is being denied by a firewall policy. Which two actions should the administrator take to identify the specific policy denying the traffic? (Choose two.)

Accepted Answer

Review the policy list and look for the policy ID shown in the debug output. The debug flow output includes the policy ID that denied the traffic. The administrator can check the policy details using 'show firewall policy <id>' or check the traffic log for the session to see which policy was matched.

Answer

Run 'diagnose debug enable' and then reproduce the issue

Answer

Use 'diagnose sys session list' to find the policy ID

Answer

Disable all firewall policies temporarily

Question 14

A FortiGate administrator is configuring an active-passive HA cluster and needs to ensure that management access is available via a dedicated management IP address that does not fail over. Which three steps should the administrator take? (Choose three.)

Accepted Answer

Assign an IP address to the management interface. To have a dedicated management IP that does not fail over, the administrator should configure a dedicated management interface (separate from HA heartbeat), assign an IP to it, and ensure the management access is configured on that interface. The management interface can be in a separate VDOM if desired.

Answer

Enable 'set ha-mgmt-interface' on the management interface

Answer

Set the management interface to be part of the HA cluster management IP

Question 15

A FortiGate administrator wants to send logs to both a local disk and a remote FortiCloud account. Which two conditions must be met for this to work? (Choose two.)

Accepted Answer

The FortiGate must have a valid FortiCloud subscription. The FortiGate must have local storage (disk) to store logs locally. It also must have connectivity to FortiCloud servers, and logging to FortiCloud must be enabled. The local disk logging is a separate configuration.

Answer

The FortiGate must be configured to log to both destinations simultaneously

Answer

The FortiGate must be in NAT mode

Answer

The FortiGate must have a policy to allow outbound traffic to FortiCloud