NSE4 High Availability and Diagnostics Practice Test 6 — 15 Questions

Question 1

A FortiGate HA cluster is operating in active-passive mode. The active unit fails over to the passive unit. After the failover, some existing TCP sessions are dropped. What is the MOST likely cause?

Accepted Answer

Session synchronization is not enabled or not working properly. TCP sessions require session synchronization to survive failover. If session sync is not configured or not functioning, sessions are lost.

Answer

The HA heartbeat interface has a high latency

Answer

The failover time is too slow, causing TCP timeouts

Answer

The TCP sessions are using NAT, which cannot be synchronized

Question 2

Which CLI command is used on a FortiGate to perform a real-time packet capture on an interface?

Accepted Answer

diagnose sniffer packet. The 'diagnose sniffer packet' command captures packets in real-time on a specified interface.

Answer

execute packet-capture

Answer

diagnose debug flow

Answer

diagnose sys session list

Question 3

You run 'diagnose sys session filter dport 443' and see the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate?

Accepted Answer

The TCP three-way handshake is incomplete; only SYN was sent. protocol 6 is TCP. proto_state=01 means TCP SYN_SENT. The session duration is 3600 seconds, expire 3599 seconds left.

Answer

The session is a UDP connection to port 443

Answer

The session will expire in 3600 seconds

Answer

The session has been established for 3600 seconds

Question 4

A FortiGate administrator wants to ensure that in an active-passive HA cluster, a specific unit becomes the primary (active) unit after a reboot. Which configuration parameter should be set to a higher value on that unit?

Accepted Answer

HA priority. The HA priority determines the active unit in active-passive mode; higher priority wins.

Answer

HA session pickup delay

Answer

HA override

Answer

HA group-id

Question 5

Which FortiGate log type records user authentication events, such as successful logins and failed login attempts?

Accepted Answer

Event logs. Event logs include audit events like authentication successes and failures.

Answer

ZTNA logs

Answer

Traffic logs

Answer

Security logs

Question 6

An administrator notices that traffic matching a firewall policy is not being logged. The policy has logging enabled. The FortiGate has local disk storage. What should the administrator check first?

Accepted Answer

The disk health and available space using 'diagnose sys disk' commands. Logging to disk requires the disk to be operational; if it's full or faulty, logs may not be written.

Answer

Whether the FortiGate has a valid FortiAnalyzer subscription

Answer

Whether FortiCloud logging is enabled

Answer

The log severity level on the policy

Question 7

In an active-active HA cluster, what is the purpose of the 'session sync' configuration?

Accepted Answer

To replicate session state so that if one unit fails, another can take over without interruption. Session sync ensures that sessions are shared between cluster units so that any unit can handle traffic for a given session.

Answer

To synchronize configuration changes between cluster members

Answer

To balance the number of sessions across cluster members

Answer

To synchronize the time between cluster members

Question 8

Which FortiGuard subscription service is required for URL filtering and web categorization?

Accepted Answer

FortiGuard Web Filtering. FortiGuard Web Filtering provides URL categorization and filtering capabilities.

Answer

FortiGuard IPS

Answer

FortiGuard Application Control

Answer

FortiGuard Antivirus

Question 9

An administrator is troubleshooting a firewall policy that should apply application control. The application control profile is configured but traffic is not being inspected. The administrator runs 'diagnose debug flow' and sees that the traffic is hitting the correct policy. What could be the issue?

Accepted Answer

The firewall policy inspection mode is set to proxy-based. Application control requires flow-based inspection; if the policy is set to proxy-based, application control may not work.

Answer

The FortiGate has not downloaded the latest application signatures

Answer

The traffic is using encryption that prevents inspection

Answer

The application control profile is not enabled on the policy

Question 10

A FortiGate administrator wants to configure Zero Trust Network Access (ZTNA) to secure access to an internal application. What is required on the FortiGate?

Accepted Answer

A ZTNA server and a ZTNA rule. ZTNA requires a ZTNA gateway on the FortiGate to proxy and verify access.

Answer

A FortiClient EMS subscription

Answer

A VPN tunnel to the application

Answer

A firewall policy with SSL inspection enabled

Question 11

An administrator is configuring HA on two FortiGates. Both units have the same model and firmware. When they are connected, neither unit becomes active. The admin checks the HA status and sees that the cluster is not formed. What is the MOST likely cause?

Accepted Answer

The heartbeat interface is not configured. HA requires at least one heartbeat interface configured on both units. Without it, they cannot communicate.

Answer

The management interface is used as a heartbeat

Answer

The HA password is incorrect

Answer

The HA group-id does not match

Question 12

A FortiGate admin wants to send logs to both a local disk and a remote FortiAnalyzer. Which log configuration must be set?

Accepted Answer

Enable local logging and configure FortiAnalyzer as a remote server. FortiGate can log to multiple destinations simultaneously by configuring both local and remote logging.

Answer

Use the 'diagnose debug application log' command

Answer

Select 'Mirror local logs to FortiAnalyzer'

Answer

Set the log severity to 'Information' on both

Question 13

Which TWO of the following are valid methods to view real-time debug output on a FortiGate? (Choose two.)

Accepted Answer

diagnose sniffer packet. Diagnose debug flow and diagnose sniffer packet are real-time debug commands. Execute tail log is not a standard command.

Answer

diagnose debug enable

Answer

diagnose sys session list

Answer

execute tail log

Question 14

An administrator is configuring an active-passive HA pair. Which THREE of the following must be identical on both units for the cluster to form? (Choose three.)

Accepted Answer

HA password. Operation mode, firmware version, and HA password (if set) must match. Priority can differ. Hostname is not required to match.

Answer

HA priority

Answer

Hostname

Question 15

A FortiGate administrator is troubleshooting why traffic from a specific source IP is not being logged. The traffic is allowed by a firewall policy with logging enabled. Which TWO commands could the administrator use to verify if the traffic is hitting the expected policy? (Choose two.)

Accepted Answer

diagnose debug flow. Diagnose debug flow traces traffic through the policy lookup. Diagnose sys session filter can show active sessions for that source IP. Sniffer packet captures packets but doesn't directly show policy match.

Answer

get system performance status

Answer

diagnose sniffer packet any 'host 10.0.0.1'

Answer

diagnose debug application fnbamd