NSE4 High Availability and Diagnostics Practice Test 5 — 15 Questions

Question 1

A FortiGate HA cluster is running in active-passive mode with two units. The administrator notices that the primary unit fails over to the secondary unit every few minutes, causing service disruption. The heartbeat interfaces are configured on port1 and port2. What is the MOST likely cause of the frequent failovers?

Accepted Answer

The heartbeat interfaces are experiencing high packet loss. High packet loss or jitter on the heartbeat link can cause the secondary unit to believe the primary is down, triggering unnecessary failovers. Heartbeat interfaces must be reliable.

Answer

Session synchronization is consuming too much bandwidth

Answer

The HA priority is set to 0 on the primary unit

Answer

The HA override setting is enabled, causing the secondary to take over

Question 2

You run 'diagnose sys session filter dport 443' and see the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate about the session?

Accepted Answer

The session is initiating a TCP connection and has not yet completed the handshake. proto_state=01 means TCP SYN_SENT state, meaning the three-way handshake is incomplete. The session is still establishing.

Answer

The session has expired and will be removed in 1 second

Answer

The session is closing and has 3599 seconds until the entry is removed

Answer

The session is fully established and has been active for 3600 seconds

Question 3

A FortiGate administrator needs to capture packets on the DMZ interface to troubleshoot a connectivity issue. Which CLI command should be used to start a packet capture?

Accepted Answer

diagnose sniffer packet. The command 'diagnose sniffer packet' is used for packet capture on FortiGate interfaces.

Answer

diagnose debug flow

Answer

diagnose sys session list

Answer

execute packet-capture start

Question 4

An administrator configures a FortiGate HA cluster in active-active mode. After enabling session synchronization, they notice that new sessions are not being synced to the secondary unit. The cluster is using a dedicated heartbeat interface. What could be the reason?

Accepted Answer

The firewall policy does not have session sync enabled. In active-active HA, session synchronization requires that the session sync flag is enabled on the firewall policy. Without it, sessions are not synced.

Answer

The HA mode is set to active-passive

Answer

The session TTL is too short

Answer

The heartbeat interface is not configured with an IP address

Question 5

An administrator runs 'diagnose debug flow' for a specific policy and sees the following output:
id=20085 trace_id=10 func=vf_ip_route_in msg='No matching interface to route packet'
What does this indicate?

Accepted Answer

The destination IP address has no matching route in the routing table. The trace indicates that FortiGate cannot find a route to forward the packet, meaning the destination is unreachable.

Answer

The packet is being blocked by a firewall policy

Answer

The source interface is down

Answer

The session table is full

Question 6

What is the purpose of the 'override' setting in FortiGate HA?

Accepted Answer

It enables the higher-priority unit to reclaim the primary role after recovery. HA override allows a device with higher priority to take over as primary after it recovers from a failure.

Answer

It allows management access to the cluster via a virtual IP

Answer

It disables HA failover during maintenance windows

Answer

It forces the secondary unit to become primary immediately

Question 7

A FortiGate administrator needs to send logs to a FortiAnalyzer device for long-term storage and analysis. Which log configuration must be set up?

Accepted Answer

Add the FortiAnalyzer as a logging destination in Log Settings. Logs are sent to FortiAnalyzer by configuring the Log Settings > Log Forwarding or the Log & Report > Log Setting to send logs to FortiAnalyzer.

Answer

Configure an IPsec tunnel to FortiAnalyzer

Answer

Enable disk logging on the FortiGate

Answer

Configure syslog server pointing to FortiAnalyzer IP

Question 8

An administrator is troubleshooting a policy that should allow HTTP traffic but it is being blocked. They run 'diagnose debug flow' and see the output ends with 'msg=deny by forward policy check'. What is the most likely cause?

Accepted Answer

The policy is configured with action DENY. The message indicates the packet was denied by a firewall policy, meaning there is no matching policy or the matching policy has action DENY.

Answer

The routing table is missing a default route

Answer

The session table is full

Answer

The HTTP traffic is not matching any policy

Question 9

What is the function of Zero Trust Network Access (ZTNA) on a FortiGate?

Accepted Answer

It allows users to securely access internal applications without a VPN, based on identity and device posture. ZTNA provides secure access to applications based on identity and device posture, without requiring a VPN.

Answer

It replaces the firewall policy for all traffic

Answer

It encrypts all traffic between the FortiGate and the internet

Answer

It is a cloud-based subscription for antivirus updates

Question 10

A FortiGate cluster is configured in active-passive HA. The administrator wants to manage the cluster using a single IP address that always points to the current primary unit. Which configuration should be applied?

Accepted Answer

Enable 'management IP' under HA configuration with the desired IP. The management interface in HA can have a virtual IP that follows the primary unit, accessible via the floating (virtual) management IP.

Answer

Configure a virtual IP (VIP) for HTTPS management

Answer

Set the HA management IP as a dedicated interface IP on each unit

Answer

Use the same IP address on both units and disable ARP

Question 11

An administrator runs 'diagnose sys session list' and sees a session with 'expire=0'. What does this indicate?

Accepted Answer

The session has expired and will be removed soon. expire=0 means the session TTL has reached zero and the session is eligible for removal in the next cleanup cycle.

Answer

The session is a long-lived session that does not expire

Answer

The session has been idle for 0 seconds

Answer

The session is permanently established and will not expire

Question 12

A FortiGate receives log messages with severity 'warning'. What is the log severity level number for 'warning' according to FortiGate's log severity levels?

Accepted Answer

4. FortiGate severity levels: Emergency=0, Alert=1, Critical=2, Error=3, Warning=4, Notification=5, Information=6, Debug=7.

Answer

3

Answer

6

Answer

5

Question 13

A FortiGate HA cluster in active-passive mode is experiencing unexpected failovers. The administrator suspects the heartbeat link is unreliable. Which TWO actions would help diagnose the heartbeat link issue? (Select two.)

Accepted Answer

Ping the heartbeat interface IP from the peer unit. Pinging the heartbeat interface IP checks connectivity; enabling debug HA heartbeat provides detailed heartbeat status.

Answer

Disable session synchronization

Answer

Configure a dedicated heartbeat interface

Answer

Increase the HA hello timer

Question 14

An administrator is troubleshooting a FortiGate that is not sending logs to FortiCloud. The FortiGate has internet connectivity and a valid FortiCloud subscription. Which THREE steps should the administrator take to resolve this issue? (Select three.)

Accepted Answer

Ensure that the log types (traffic, event, security) are enabled for FortiCloud. The three correct steps are: verify FortiCloud status to ensure registration, check allowed log types, and verify DNS resolution (FortiCloud uses FQDN).

Answer

Increase the log buffer size

Answer

Disable the antivirus profile temporarily

Question 15

A FortiGate administrator needs to ensure that a specific traffic flow is fully inspected by the antivirus and IPS profiles. The traffic is HTTPS. Which THREE configuration items are required? (Select three.)

Accepted Answer

Apply an IPS profile to the firewall policy. SSL inspection is required to decrypt HTTPS; then antivirus and IPS profiles can inspect the decrypted traffic. The firewall policy must include these profiles.

Answer

Enable flow-based inspection mode globally

Answer

Configure a DNS filter profile