NSE4 High Availability and Diagnostics Practice Test 6 — 15 Questions

Question 1

A FortiGate in an active-active HA cluster is experiencing asymmetric routing. The administrator runs 'diagnose debug flow' on a packet from a client to a server. The flow trace shows the packet is allowed by policy, but the response is dropped. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The session synchronization is not enabled between cluster members. In an active-active HA cluster, session synchronization (session-pickup / session-sync) must be enabled so that return traffic arriving on a different cluster member finds the existing session. If sync is disabled, the secondary unit has no session entry and drops the response, producing the asymmetric-routing drop seen in the debug flow.

Answer

The TTL of the packet is too low

Answer

The HA mode should be changed to active-passive

Answer

The policy on the secondary unit has a different schedule

Question 2

An organization wants to send FortiGate logs to a central log management system for long-term storage and compliance. Which FortiGate feature is specifically designed for collecting and analyzing logs from multiple FortiGate devices?

Accepted Answer

FortiAnalyzer. FortiAnalyzer is Fortinet's dedicated centralized logging, analysis, and reporting appliance (physical or virtual) designed to collect logs from multiple FortiGate devices, FortiSwitches, FortiAPs, and other Fortinet products. It provides long-term storage, compliance reporting, and advanced analytics such as event correlation and security fabric rating. Unlike local disk logging, FortiAnalyzer aggregates logs from many devices into a single repository, making it the correct choice for centralized log management.

Answer

Disk logging

Answer

FortiGuard

Answer

FortiCloud

Question 3

A FortiGate administrator wants to see real-time debugging output for traffic matching a specific source IP address. Which command sequence would achieve this?

Accepted Answer

diagnose debug flow filter src 10.0.1.10 ; diagnose debug flow show function-name ; diagnose debug enable. The 'diagnose debug flow' command sequence is specifically designed for real-time debugging of traffic flows, allowing filtering by source IP with the 'filter src' option. Enabling debug output with 'diagnose debug enable' then shows flow trace information for packets matching the filter, which is the standard method for live traffic debugging on FortiGate.

Answer

diagnose sys session filter src 10.0.1.10 ; diagnose sys session list

Answer

diagnose sniffer packet any 'host 10.0.1.10' 4

Answer

diagnose debug reset ; diagnose debug enable ; diagnose debug flow show iprope

Question 4

A FortiGate administrator has configured an active-passive HA cluster. After a failover event, the former primary unit comes back online and immediately takes over as primary again, causing another failover. The administrator wants the original primary to stay in standby until the current primary fails. Which setting should be configured?

Accepted Answer

Disable HA override on both units. HA override (set ha-override enable) causes a device to resume primary role when it becomes available with higher priority. Disabling override prevents this preemptive behavior.

Answer

Enable HA override on both units

Answer

Set the HA mode to active-active

Answer

Increase the HA priority on the primary unit

Question 5

Which FortiGate log severity level indicates that a system is unusable and requires immediate attention?

Accepted Answer

Emergency. Emergency is the highest severity level in syslog/FortiGate, indicating a system is unusable. Critical indicates critical conditions but not necessarily unusable.

Answer

Error

Answer

Critical

Answer

Alert

Question 6

A FortiGate administrator needs to ensure that traffic logs are sent to a FortiAnalyzer even when the FortiGate's local disk is full. What configuration is required?

Accepted Answer

Enable 'remote log' under Log Settings and specify the FortiAnalyzer IP. To ensure logs are sent to FortiAnalyzer even when the local disk is full, the administrator must enable remote logging under Log Settings and specify the FortiAnalyzer IP. This configures the FortiGate to send logs to the remote server independently of local disk status.

Answer

Enable 'disk logging' with rollover policy

Answer

Increase the log severity to 'emergency' only

Answer

Configure a log filter to send only security logs

Question 7

A FortiGate administrator notices that after upgrading the firmware, the HA cluster fails to form. Both units show the correct HA configuration. What is the most likely cause?

Accepted Answer

The firmware versions are different on the two units. FortiGate HA requires that all cluster members run the same firmware version. After an upgrade, if one unit is upgraded and the other is not, the HA cluster will not form because the HA protocol version and heartbeat packet format may differ. The units will show correct HA configuration but will not establish a heartbeat due to version mismatch. This is a common issue during firmware upgrades in an HA cluster.

Answer

The HA heartbeat interfaces are not connected

Answer

The HA mode is set to active-active on one unit and active-passive on the other

Answer

The HA priority values are identical

Question 8

Which of the following log types on FortiGate records traffic that is denied by a firewall policy?

Accepted Answer

Traffic logs. Traffic logs on a FortiGate record all traffic that passes through or is denied by the firewall, including the source/destination, service, action (accept/deny), and policy that matched. When a firewall policy blocks traffic, the deny action is captured in the traffic log with the corresponding policy ID, making it the correct log type for identifying denied sessions.

Answer

HA logs

Answer

Event logs

Answer

Security logs

Question 9

A FortiGate administrator is troubleshooting an issue where HTTPS traffic is not being properly inspected by the web filter. The policy has SSL inspection enabled. Which TWO commands would provide the most useful real-time debugging information? (Choose two.)

Accepted Answer

diagnose debug flow filter dport 443 ; diagnose debug flow show function-name ; diagnose debug enable. Option B is correct because the debug flow commands (diagnose debug flow filter dport 443, diagnose debug flow show function-name, diagnose debug enable) provide real-time packet-path tracing that shows whether the HTTPS session is being matched to the firewall policy and whether SSL inspection is applied, which is essential for troubleshooting web-filter inspection issues. Option E is correct because diagnose sniffer packet any 'port 443' 4 captures live packets on port 443 with interface information, allowing the administrator to verify that HTTPS traffic is actually reaching the FortiGate and to observe the handshake behavior in real time. Option A is not appropriate because diagnose test application ips 1 only tests IPS engine operation and does not trace HTTPS web-filter or SSL-inspection processing. Option C is not the best choice because diagnose sys session filter dport 443 with diagnose sys session list only shows the session table entries and does not provide real-time debugging of the inspection path. Option D is not suitable because execute log display only shows already-generated log entries and does not deliver live debugging information.

Answer

diagnose test application ips 1

Answer

diagnose sys session filter dport 443 ; diagnose sys session list

Answer

execute log display

Question 10

A FortiGate administrator is investigating a performance issue and suspects that a large number of incomplete TCP connections are consuming session table resources. Which TWO commands would help identify such sessions? (Choose two.)

Accepted Answer

diagnose sys session stat. Diagnose sys session list with filter can show sessions by state. Diagnose sys session stat shows counts by state. The sniffer shows packets, not session state; debug flow is for tracing specific streams.

Answer

diagnose debug flow filter dport 80 ; diagnose debug enable

Answer

diagnose sniffer packet any 'tcp' 4

Answer

diagnose sys session filter proto 6 ; diagnose sys session list

Question 11

A FortiGate administrator needs to forward logs to a FortiAnalyzer for centralized management. The FortiAnalyzer is reachable at 10.0.1.100. Which configuration step is required on the FortiGate to send logs to this FortiAnalyzer?

Accepted Answer

Configure the FortiAnalyzer in System > FortiAnalyzer. To send logs to FortiAnalyzer, the administrator must configure the FortiAnalyzer server under System > FortiAnalyzer or via CLI using 'config log fortianalyzer setting set server 10.0.1.100'. The log forwarding policy is not used for FortiAnalyzer.

Answer

Configure a syslog server under Log Setting

Answer

Add a firewall policy allowing traffic from FortiGate to FortiAnalyzer

Answer

Enable logging to FortiCloud instead

Question 12

An administrator is troubleshooting a FortiGate HA cluster that is experiencing frequent failovers. The heartbeat interfaces are configured on port1 and port2. Which diagnostic command should the administrator use to check heartbeat packet loss?

Accepted Answer

diagnose sys ha heartbeat. The 'diagnose sys ha heartbeat' command is the dedicated diagnostic tool for inspecting HA heartbeat interface statistics, including packet counts, errors, and loss on the configured heartbeat ports (port1 and port2 in this scenario). It shows per-interface heartbeat traffic details that directly reveal whether heartbeats are being dropped, which is the root cause of frequent failovers. This is the only option that targets heartbeat packet-level diagnostics rather than general HA state.

Answer

diagnose sys ha status

Answer

get system ha status

Answer

diagnose sys session list

Question 13

Which log severity level indicates that a device is unusable and requires immediate attention?

Accepted Answer

Emergency. FortiGate log severity levels are: Emergency (0), Alert (1), Critical (2), Error (3), Warning (4), Notification (5), Information (6), Debug (7). Emergency is the highest severity, indicating the system is unusable.

Answer

Error

Answer

Critical

Answer

Alert

Question 14

A FortiGate administrator wants to configure ZTNA to secure access to an internal application. Which of the following components is essential for ZTNA to function?

Accepted Answer

FortiClient EMS. FortiClient EMS (Enterprise Management Server) is essential for ZTNA because it manages endpoints, enforces compliance, and provides the client certificate and posture information required for zero-trust access decisions. Without FortiClient EMS, the FortiGate cannot verify device identity and health.

Answer

FortiCloud

Answer

FortiAnalyzer

Answer

A VPN tunnel to the client

Question 15

An administrator runs 'diagnose debug flow' for a specific source IP and sees the output includes 'no matching policy'. The FortiGate has a firewall policy that should match the traffic. What is the most likely reason for this message?

Accepted Answer

The firewall policy is disabled or the source/destination interfaces do not match the traffic's ingress/egress interfaces. 'No matching policy' in diagnose debug flow means the FortiGate evaluated the packet against the policy list and found no policy whose ingress interface, egress interface, source, destination, schedule, and service all matched. The most common causes are a disabled policy or an interface mismatch (traffic arriving on an interface the policy does not list as incoming).

Answer

The FortiGate's routing table does not have a route for the destination

Answer

The security profiles applied to the policy are blocking the traffic

Answer

The session table is full and cannot accept new sessions