NSE4 High Availability and Diagnostics Practice Test 5 — 15 Questions

Question 1

A FortiGate administrator needs to send logs to a FortiAnalyzer device for long-term storage and analysis. Which log configuration must be set up?

Accepted Answer

Add the FortiAnalyzer as a logging destination in Log Settings. Logs are sent to FortiAnalyzer by configuring the Log Settings > Log Forwarding or the Log & Report > Log Setting to send logs to FortiAnalyzer.

Answer

Configure an IPsec tunnel to FortiAnalyzer

Answer

Enable disk logging on the FortiGate

Answer

Configure syslog server pointing to FortiAnalyzer IP

Question 2

An administrator is troubleshooting a policy that should allow HTTP traffic but it is being blocked. They run 'diagnose debug flow' and see the output ends with 'msg=deny by forward policy check'. What is the most likely cause?

Accepted Answer

The policy is configured with action DENY. The message indicates the packet was denied by a firewall policy, meaning there is no matching policy or the matching policy has action DENY.

Answer

The routing table is missing a default route

Answer

The session table is full

Answer

The HTTP traffic is not matching any policy

Question 3

What is the function of Zero Trust Network Access (ZTNA) on a FortiGate?

Accepted Answer

It allows users to securely access internal applications without a VPN, based on identity and device posture. ZTNA provides secure access to applications based on identity and device posture, without requiring a VPN.

Answer

It replaces the firewall policy for all traffic

Answer

It encrypts all traffic between the FortiGate and the internet

Answer

It is a cloud-based subscription for antivirus updates

Question 4

A FortiGate cluster is configured in active-passive HA. The administrator wants to manage the cluster using a single IP address that always points to the current primary unit. Which configuration should be applied?

Accepted Answer

Enable 'management IP' under HA configuration with the desired IP. The management interface in HA can have a virtual IP that follows the primary unit, accessible via the floating (virtual) management IP.

Answer

Configure a virtual IP (VIP) for HTTPS management

Answer

Set the HA management IP as a dedicated interface IP on each unit

Answer

Use the same IP address on both units and disable ARP

Question 5

An administrator runs 'diagnose sys session list' and sees a session with 'expire=0'. What does this indicate?

Accepted Answer

The session has expired and will be removed soon. expire=0 means the session TTL has reached zero and the session is eligible for removal in the next cleanup cycle.

Answer

The session is a long-lived session that does not expire

Answer

The session has been idle for 0 seconds

Answer

The session is permanently established and will not expire

Question 6

A FortiGate receives log messages with severity 'warning'. What is the log severity level number for 'warning' according to FortiGate's log severity levels?

Accepted Answer

4. FortiGate severity levels: Emergency=0, Alert=1, Critical=2, Error=3, Warning=4, Notification=5, Information=6, Debug=7.

Answer

3

Answer

6

Answer

5

Question 7

A FortiGate HA cluster in active-passive mode is experiencing unexpected failovers. The administrator suspects the heartbeat link is unreliable. Which TWO actions would help diagnose the heartbeat link issue? (Select two.)

Accepted Answer

Ping the heartbeat interface IP from the peer unit. Pinging the heartbeat interface IP checks connectivity; enabling debug HA heartbeat provides detailed heartbeat status.

Answer

Disable session synchronization

Answer

Configure a dedicated heartbeat interface

Answer

Increase the HA hello timer

Question 8

An administrator is troubleshooting a FortiGate that is not sending logs to FortiCloud. The FortiGate has internet connectivity and a valid FortiCloud subscription. Which THREE steps should the administrator take to resolve this issue? (Select three.)

Accepted Answer

Ensure that the log types (traffic, event, security) are enabled for FortiCloud. The three correct steps are: verify FortiCloud status to ensure registration, check allowed log types, and verify DNS resolution (FortiCloud uses FQDN).

Answer

Increase the log buffer size

Answer

Disable the antivirus profile temporarily

Question 9

A FortiGate administrator needs to ensure that a specific traffic flow is fully inspected by the antivirus and IPS profiles. The traffic is HTTPS. Which THREE configuration items are required? (Select three.)

Accepted Answer

Apply an IPS profile to the firewall policy. To inspect HTTPS traffic with antivirus and IPS, you must apply both the antivirus and IPS profiles to the firewall policy (options B and C) and enable SSL/TSL deep inspection (option D) to decrypt the traffic. Flow-based inspection mode (option A) is a global setting that is not specifically required for this configuration.

Answer

Enable flow-based inspection mode globally

Answer

Configure a DNS filter profile

Question 10

A FortiGate HA cluster is operating in active-passive mode. The active unit fails over to the passive unit. After the failover, some existing TCP sessions are dropped. What is the MOST likely cause?

Accepted Answer

Session synchronization is not enabled or not working properly. TCP sessions require session synchronization to survive failover. If session sync is not configured or not functioning, sessions are lost.

Answer

The HA heartbeat interface has a high latency

Answer

The failover time is too slow, causing TCP timeouts

Answer

The TCP sessions are using NAT, which cannot be synchronized

Question 11

Which CLI command is used on a FortiGate to perform a real-time packet capture on an interface?

Accepted Answer

diagnose sniffer packet. The 'diagnose sniffer packet' command captures packets in real-time on a specified interface.

Answer

execute packet-capture

Answer

diagnose debug flow

Answer

diagnose sys session list

Question 12

You run 'diagnose sys session filter dport 443' and see the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate?

Accepted Answer

The TCP three-way handshake is incomplete; only SYN was sent. protocol 6 is TCP. proto_state=01 means TCP SYN_SENT. The session duration is 3600 seconds, expire 3599 seconds left.

Answer

The session is a UDP connection to port 443

Answer

The session will expire in 3600 seconds

Answer

The session has been established for 3600 seconds

Question 13

A FortiGate administrator wants to ensure that in an active-passive HA cluster, a specific unit becomes the primary (active) unit after a reboot. Which configuration parameter should be set to a higher value on that unit?

Accepted Answer

HA priority. The HA priority determines the active unit in active-passive mode; higher priority wins.

Answer

HA session pickup delay

Answer

HA override

Answer

HA group-id

Question 14

Which FortiGate log type records user authentication events, such as successful logins and failed login attempts?

Accepted Answer

Event logs. Event logs include audit events like authentication successes and failures.

Answer

ZTNA logs

Answer

Traffic logs

Answer

Security logs

Question 15

An administrator notices that traffic matching a firewall policy is not being logged. The policy has logging enabled. The FortiGate has local disk storage. What should the administrator check first?

Accepted Answer

The disk health and available space using 'diagnose sys disk' commands. Logging to disk requires the disk to be operational; if it's full or faulty, logs may not be written.

Answer

Whether the FortiGate has a valid FortiAnalyzer subscription

Answer

Whether FortiCloud logging is enabled

Answer

The log severity level on the policy