NSE4 High Availability and Diagnostics Practice Test 5 — 15 Questions

Question 1

A company has two FortiGate 100F units in an active-passive HA cluster with firmware version 7.2.5. The cluster is configured with session pickup and all interfaces are monitored. The network consists of three VLANs: VLAN10 (Users), VLAN20 (Servers), and VLAN30 (DMZ). The cluster is connected to two ISPs: ISP1 (port1) and ISP2 (port2). The internal network uses a single aggregated link (port3 and port4) as a LAG to the core switch. One day, the primary FortiGate experiences a hardware failure and the secondary takes over. After the primary is replaced and rejoins the cluster, the administrator notices that traffic passing through the cluster is intermittently dropping for a few seconds every minute. The administrator checks the cluster status and sees that the new primary (previously secondary) is in 'primary' state and the old primary (newly replaced) is in 'secondary' state. What is the most likely cause of the intermittent traffic drops?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The LAG configuration on the new FortiGate does not match the active cluster configuration.. The most likely cause is that the LAG configuration on the newly replaced FortiGate does not match the active cluster configuration. In an HA cluster, all LAG member interfaces (port3 and port4) must have identical settings—including LACP mode, speed, duplex, and VLAN membership—on both units. When the secondary FortiGate became primary and the replaced unit rejoined as secondary, any mismatch in the LAG configuration would cause the cluster to continuously renegotiate or flap the aggregated link, leading to intermittent traffic drops every few seconds as the HA cluster attempts to synchronize and stabilize the interface state.

Answer

Session pickup is not enabled on the new FortiGate.

Answer

The HA cluster is in split-brain state.

Answer

The heartbeat interface is configured on the LAG, causing HA instability.

Question 2

A FortiGate is configured in an A-P HA cluster. The administrator wants to ensure that session failover occurs for UDP-based voice traffic. Which TWO settings must be enabled?

Accepted Answer

Enable UDP session synchronization.. UDP session synchronization must be enabled to replicate UDP session state between HA cluster members, ensuring that active sessions for voice traffic (which typically uses UDP) are seamlessly taken over by the standby unit during a failover. Without this setting, UDP sessions are not synchronized by default, and voice calls would drop.

Answer

Set HA override to enabled.

Answer

Enable configuration synchronization.

Answer

Set failover hold time to 1 second.

Question 3

Match each FortiGate routing concept to its definition.

Accepted Answer

Static routing: manually configured routes. In FortiGate, static routing relies on manual configuration, while dynamic routing uses protocols like OSPF and BGP. Policy-based routing forwards based on packet characteristics, and ECMP load-balances over equal-cost paths. Common confusions involve swapping the definitions of static and dynamic routing, or confusing dynamic routing with policy-based routing.

Answer

Static routing: routes learned via routing protocols

Answer

Dynamic routing: routing based on packet attributes

Question 4

An administrator has configured an active-passive HA cluster. During a failover test, the standby unit becomes active but existing user sessions are lost, requiring users to re-establish connections. Which configuration change would prevent this behavior?

Accepted Answer

Enable session pickup. In an active-passive FortiGate HA cluster, session pickup (also called session synchronization) is the feature that replicates the session table from the primary to the standby unit. Without it enabled, when failover occurs the standby unit has no knowledge of existing sessions and drops them, forcing users to reconnect. Enabling session pickup ensures the standby has a mirrored session table so established connections continue through the failover.

Answer

Lower HA priority on the primary

Answer

Set HA override to enabled

Answer

Increase the heartbeat interval

Question 5

An administrator executes 'diagnose debug flow' for a specific session and sees the output: 'id=20085 trace_id=10 func=print_pkt_detail line=5567 msg="vd-root:0 received packet via port1".' Later, the trace shows 'msg="Deny by policy"'. What is the most likely next step the administrator should take?

Accepted Answer

Review the firewall policies that apply to the traffic and modify as needed. The debug flow output shows the packet was received on port1 and then hit 'Deny by policy', meaning a firewall policy explicitly blocked the traffic. The next logical step is to review the firewall policies that match the traffic's source, destination, service, and incoming interface, and adjust them to permit the intended flow.

Answer

Check the routing table for the destination

Answer

Restart the FortiGate to clear session table

Answer

Enable session helper for the protocol

Question 6

A FortiGate administrator needs to send logs to an external FortiAnalyzer for centralized monitoring. Which log configuration step is required?

Accepted Answer

Add the FortiAnalyzer as a logging device in System > FortiAnalyzer. To send logs from a FortiGate to an external FortiAnalyzer for centralized monitoring, the administrator must add the FortiAnalyzer as a logging device under System > FortiAnalyzer. This step establishes the secure, authenticated connection (typically using FortiGate's proprietary protocol over TCP/514 or TCP/3000) and enables log forwarding to the FortiAnalyzer. Without this configuration, the FortiGate will not send logs to the FortiAnalyzer, even if other logging methods are enabled.

Answer

Configure syslog server

Answer

Enable FortiCloud logging

Answer

Enable disk logging on the FortiGate

Question 7

What is the purpose of the heartbeat interface in a FortiGate HA cluster?

Accepted Answer

To exchange HA heartbeat messages for health monitoring. The heartbeat interface in a FortiGate HA cluster is dedicated to exchanging HA heartbeat messages between cluster members. These messages are used to monitor the health and availability of each unit, enabling failover detection and ensuring cluster stability. It does not handle session synchronization, management access, or user traffic forwarding.

Answer

To synchronize session tables and configuration

Answer

To provide out-of-band management access

Answer

To forward user traffic between cluster members

Question 8

An administrator runs 'diagnose sys session filter dport 443' and then 'diagnose sys session list'. The output shows many sessions with 'proto_state=01' and 'expire=3599'. What does 'expire=3599' indicate?

Accepted Answer

The session will timeout in 3599 seconds. In FortiGate diagnostics, the 'expire' field in the session list output indicates the remaining time in seconds before the session times out. A value of 3599 seconds means the session will be removed from the session table after that many seconds of inactivity, assuming no further traffic matches the session. This is a key metric for understanding session lifecycle and timeout behavior.

Answer

The session has 3599 packets

Answer

The session has been alive for 3599 seconds

Answer

The session has 3599 bytes of data transferred

Question 9

During a failover in an active-passive HA cluster, the newly active unit does not have the same session table as the previous primary, causing all existing sessions to drop. Which setting should the administrator verify?

Accepted Answer

The session pickup setting is enabled. Session synchronization must be enabled and properly configured to replicate sessions to the standby unit.

Answer

HA override is enabled on both units

Answer

The heartbeat interface is configured as a dedicated management interface

Answer

The cluster is operating in active-active mode

Question 10

Which log severity level indicates a failure that requires immediate attention?

Accepted Answer

Emergency. In Fortinet's FortiOS, log severity levels follow the standard syslog protocol (RFC 5424). The 'Emergency' level (severity 0) indicates a system is unusable or has experienced a critical failure that requires immediate administrator intervention, such as a hardware failure or a security breach. This is the highest severity level, designed to alert for urgent action.

Answer

Debug

Answer

Warning

Answer

Information

Question 11

An administrator notices that the FortiGate HA cluster has two units, but only one is shown as 'primary' and the other as 'standby'. The administrator did not configure any load balancing. Which HA mode is in use?

Accepted Answer

Active-passive. In active-passive HA mode, one FortiGate unit is the primary (active) and the other is the standby (passive), with no traffic load balancing between them. The scenario describes exactly one primary and one standby with no load balancing configured, which matches active-passive. Active-active would show both units processing traffic, and load-balanced cluster is not a FortiGate HA mode.

Answer

Load-balanced cluster

Answer

Standalone

Answer

Active-active

Question 12

A FortiGate admin wants to inspect SSL-encrypted traffic for threats using IPS. The admin creates an SSL inspection profile with 'full SSL inspection' and applies it to the policy. What additional configuration is necessary for the IPS engine to process the decrypted traffic?

Accepted Answer

Apply an IPS sensor to the same firewall policy. IPS inspection requires that the security profile (IPS sensor) is also applied to the same firewall policy. SSL inspection alone only decrypts; the IPS profile inspects the decrypted traffic.

Answer

Enable 'set ssl-ssh-profile' under the IPS sensor

Answer

Enable 'IPS' under the SSL inspection profile

Answer

Configure the FortiGate's CA certificate on clients

Question 13

An active-passive HA cluster is experiencing frequent failovers. Which TWO factors could cause unnecessary failovers? (Choose two.)

Accepted Answer

Using a data interface as the heartbeat interface. Incorrect heartbeat interface configuration (e.g., using a busy data port) can cause false positives. A mismatched HA password prevents proper communication, but may not cause failover; mismatched priority affects role selection, not failover frequency. Unstable heartbeat links cause failover.

Answer

Different firmware versions on cluster members

Answer

Mismatched HA passwords between cluster members

Answer

Mismatched HA priority values

Question 14

A FortiGate administrator has configured an active-passive HA cluster with two units. During a failover test, they notice that existing TCP sessions are dropped and must be re-established. What configuration change should the administrator make to ensure sessions are preserved during failover?

Accepted Answer

Enable session synchronization between the cluster members. Session synchronization (session sync) allows the active unit to share session table entries with the passive unit. During failover, the new active unit has the session table pre-populated, so existing sessions continue without interruption.

Answer

Configure a dedicated heartbeat interface

Answer

Enable HA override

Answer

Increase the HA priority on the primary unit

Question 15

Which FortiGate diagnostic command allows you to capture packets on an interface for troubleshooting network connectivity issues?

Accepted Answer

diagnose sniffer packet. The 'diagnose sniffer packet' command on a FortiGate captures packets on a specified interface, similar to tcpdump. It allows administrators to see live packet data for troubleshooting connectivity, filtering by interface, protocol, host, port, and verbosity level. This is the correct tool for packet-level capture.

Answer

diagnose debug flow

Answer

diagnose sys session list

Answer

diagnose test application