NSE4 High Availability and Diagnostics Practice Test 6 — 15 Questions

Question 1

In an active-active HA cluster, what is the purpose of the 'session sync' configuration?

Accepted Answer

To replicate session state so that if one unit fails, another can take over without interruption. Session sync ensures that sessions are shared between cluster units so that any unit can handle traffic for a given session.

Answer

To synchronize configuration changes between cluster members

Answer

To balance the number of sessions across cluster members

Answer

To synchronize the time between cluster members

Question 2

Which FortiGuard subscription service is required for URL filtering and web categorization?

Accepted Answer

FortiGuard Web Filtering. FortiGuard Web Filtering provides URL categorization and filtering capabilities.

Answer

FortiGuard IPS

Answer

FortiGuard Application Control

Answer

FortiGuard Antivirus

Question 3

An administrator is troubleshooting a firewall policy that should apply application control. The application control profile is configured but traffic is not being inspected. The administrator runs 'diagnose debug flow' and sees that the traffic is hitting the correct policy. What could be the issue?

Accepted Answer

The firewall policy inspection mode is set to proxy-based. Application control requires flow-based inspection; if the policy is set to proxy-based, application control may not work.

Answer

The FortiGate has not downloaded the latest application signatures

Answer

The traffic is using encryption that prevents inspection

Answer

The application control profile is not enabled on the policy

Question 4

A FortiGate administrator wants to configure Zero Trust Network Access (ZTNA) to secure access to an internal application. What is required on the FortiGate?

Accepted Answer

A ZTNA server and a ZTNA rule. ZTNA requires a ZTNA gateway on the FortiGate to proxy and verify access.

Answer

A FortiClient EMS subscription

Answer

A VPN tunnel to the application

Answer

A firewall policy with SSL inspection enabled

Question 5

An administrator is configuring HA on two FortiGates. Both units have the same model and firmware. When they are connected, neither unit becomes active. The admin checks the HA status and sees that the cluster is not formed. What is the MOST likely cause?

Accepted Answer

The heartbeat interface is not configured. HA requires at least one heartbeat interface configured on both units. Without it, they cannot communicate.

Answer

The management interface is used as a heartbeat

Answer

The HA password is incorrect

Answer

The HA group-id does not match

Question 6

A FortiGate admin wants to send logs to both a local disk and a remote FortiAnalyzer. Which log configuration must be set?

Accepted Answer

Enable local logging and configure FortiAnalyzer as a remote server. FortiGate can log to multiple destinations simultaneously by configuring both local and remote logging.

Answer

Use the 'diagnose debug application log' command

Answer

Select 'Mirror local logs to FortiAnalyzer'

Answer

Set the log severity to 'Information' on both

Question 7

Which TWO of the following are valid methods to view real-time debug output on a FortiGate? (Choose two.)

Accepted Answer

diagnose sniffer packet. Diagnose debug flow and diagnose sniffer packet are real-time debug commands. Execute tail log is not a standard command.

Answer

diagnose debug enable

Answer

diagnose sys session list

Answer

execute tail log

Question 8

An administrator is configuring an active-passive HA pair. Which THREE of the following must be identical on both units for the cluster to form? (Choose three.)

Accepted Answer

HA password. Operation mode, firmware version, and HA password (if set) must match. Priority can differ. Hostname is not required to match.

Answer

HA priority

Answer

Hostname

Question 9

A FortiGate administrator is troubleshooting why traffic from a specific source IP is not being logged. The traffic is allowed by a firewall policy with logging enabled. Which TWO commands could the administrator use to verify if the traffic is hitting the expected policy? (Choose two.)

Accepted Answer

diagnose debug flow. Diagnose debug flow traces traffic through the policy lookup. Diagnose sys session filter can show active sessions for that source IP. Sniffer packet captures packets but doesn't directly show policy match.

Answer

get system performance status

Answer

diagnose sniffer packet any 'host 10.0.0.1'

Answer

diagnose debug application fnbamd

Question 10

A FortiGate admin runs 'diagnose sys session filter dport 443' and then 'diagnose sys session list'. The output shows a session with 'proto=6 proto_state=01 duration=3600 expire=3599'. What does this indicate about the session?

Accepted Answer

The session is in a half-open state, waiting for SYN-ACK. Protocol 6 is TCP, proto_state=01 indicates TCP SYN_SENT state (the first step of the three-way handshake). Duration and expire are in seconds. The session has been open for 3600 seconds (1 hour) and will expire in 3599 seconds, which is unusual for a TCP session that should have completed handshake quickly. This suggests the session is stuck in SYN_SENT, likely due to no SYN-ACK response.

Answer

The session is closing with a FIN flag

Answer

The session is fully established and transferring data

Answer

The session was blocked by a firewall policy

Question 11

An administrator is configuring an active-passive HA cluster and wants to ensure that the secondary unit can be monitored and managed directly via HTTPS even when it is not the primary. Which setting must be enabled?

Accepted Answer

Enable 'set management-ip' on the HA configuration. In active-passive HA, the management interface allows individual management of each unit. Enabling 'management interface' on a dedicated interface (or a VLAN) gives each unit its own IP address for out-of-band management, independent of the HA cluster IP.

Answer

Use the same IP address for both units with different ports

Answer

Configure a virtual IP address for management in the firewall policy

Answer

Set 'ha-mgmt-status enable' on the interface

Question 12

A FortiGate admin is troubleshooting intermittent VPN disconnections. The admin enables debug flow with 'diagnose debug flow filter daddr 10.0.0.1' and 'diagnose debug flow trace start 10'. The output shows 'msg: send to x.x.x.x via intf port1' but then immediately 'msg: no matching policy'. However, the firewall policy list shows a policy that should match. What is the most likely cause?

Accepted Answer

A static route is missing or incorrect, causing the traffic to exit the wrong interface. The 'no matching policy' message indicates that the traffic did not match any policy. Since the debug shows the traffic is going out via port1, but the policy might be configured on a different interface (e.g., the VPN interface). In a VPN scenario, traffic destined for the remote subnet must match a policy from the VPN tunnel interface to the destination. If the traffic is being routed out port1 (the physical WAN) instead of through the VPN tunnel, the policy check fails. This is often due to missing or incorrect routing. Alternatively, the policy might be correctly configured but the traffic is being processed on the wrong VDOM, but the routing issue is more common.

Answer

The policy's source interface is not the incoming interface

Answer

The firewall policy is disabled

Answer

The VPN tunnel is down

Question 13

An administrator needs to ensure that in an active-passive HA cluster, the primary unit always remains the preferred master unless it fails, regardless of other factors. The administrator sets the primary's HA priority to 200 and the secondary to 100. However, after a reboot of the primary, the secondary becomes the primary. What additional step is required?

Accepted Answer

Set 'set override enable' under config system ha. In HA, the 'override' setting (or 'set override enable') ensures that when the primary recovers, it will preempt the current primary and become active again. Without override, the cluster uses a non-preemptive mode: once a unit becomes primary, it stays primary even if a higher-priority unit comes back online.

Answer

Set 'set ha-mgmt-status enable' on the primary

Answer

Reduce the secondary priority to 0

Answer

Increase the primary priority to 255

Question 14

An administrator wants to monitor real-time traffic flows on a FortiGate, specifically to see packet details for traffic matching certain criteria. Which command should the administrator use to capture live packets on an interface?

Accepted Answer

diagnose sniffer packet. The 'diagnose sniffer packet' command is the built-in packet capture tool on FortiGate. It allows capturing packets on interfaces with filters for IP, port, protocol, etc. Example: 'diagnose sniffer packet any "host 10.0.0.1" 4'.

Answer

diagnose debug enable and diagnose debug flow trace

Answer

diagnose sys session list

Answer

execute system grep from CLI

Question 15

An administrator is troubleshooting a slow web application. The admin suspects that the FortiGate's session table might be full, causing new sessions to be dropped. Which command should the admin use to check the current session table utilization?

Accepted Answer

diagnose sys session stat. The 'diagnose sys session stat' command displays statistics about the session table, including the number of current sessions and the maximum allowed. This helps determine if the session table is near capacity.

Answer

get system performance status

Answer

diagnose sys session list

Answer

diagnose sys session filter