NSE4 High Availability and Diagnostics Practice Test 7 — 15 Questions

Question 1

A FortiGate cluster in active-passive HA is configured with two heartbeat interfaces. The primary unit fails completely. The secondary unit detects the failure and becomes primary. After the original primary recovers, it remains in passive mode. What is the most likely reason for this behavior?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The HA override setting is disabled. When override is disabled (the default), the recovered unit will not preempt the current primary. The cluster stays with the current primary until it fails. This is the expected behavior for graceful recovery.

Answer

The heartbeat interfaces are not properly configured

Answer

The priority of the original primary is lower than the current primary

Answer

The HA override setting is enabled

Question 2

Which FortiGate log type records information about firewall policy matches and traffic statistics?

Accepted Answer

Traffic logs. FortiGate traffic logs record information about firewall policy matches, including source and destination IP addresses, ports, protocols, and the action taken (allow/deny). They also include traffic statistics such as bytes sent and received. Therefore, traffic logs are the correct log type for this information.

Answer

Event logs

Answer

Audit logs

Answer

Security logs

Question 3

In an active-active HA cluster, session synchronization is enabled. What is the primary purpose of session synchronization in this mode?

Accepted Answer

To ensure that sessions are not lost if a cluster unit fails. Session synchronization in an active-active HA cluster ensures that session state (such as TCP connection state, NAT translations, and sequence numbers) is replicated between cluster members. If one unit fails, the surviving unit already has the session information and can continue forwarding traffic without dropping existing connections.

Answer

To synchronize firewall policies between cluster members

Answer

To load balance traffic across the cluster

Answer

To reduce the number of sessions on each unit

Question 4

A FortiGate administrator is troubleshooting a traffic issue where users cannot access a specific website. The administrator runs 'diagnose debug flow' and sees the output indicating that traffic is being denied by a firewall policy. Which two actions should the administrator take to identify the specific policy denying the traffic? (Choose two.)

Accepted Answer

Review the policy list and look for the policy ID shown in the debug output. Option C is correct because the 'diagnose debug flow' output explicitly prints the policy ID (e.g., 'matched policy 5') that denied the traffic, so reviewing the firewall policy list for that ID pinpoints the exact offending policy. Option D is correct because FortiGate traffic logs record the policy ID (policyid) for each session, so checking the log entry for the denied session reveals the same policy identifier and confirms which rule blocked the traffic. Option A is not the right action because 'diagnose debug enable' only turns on debug output; it does not itself identify the policy, and the administrator has already captured the flow output. Option B is incorrect because 'diagnose sys session list' shows session details such as source/destination and state, but it does not reliably surface the denying policy ID for a denied flow. Option E is incorrect and dangerous because disabling all firewall policies would remove security enforcement and is not a valid troubleshooting step.

Answer

Run 'diagnose debug enable' and then reproduce the issue

Answer

Use 'diagnose sys session list' to find the policy ID

Answer

Disable all firewall policies temporarily

Question 5

A FortiGate administrator wants to send logs to both a local disk and a remote FortiCloud account. Which two conditions must be met for this to work? (Choose two.)

Accepted Answer

The FortiGate must have a valid FortiCloud subscription. The FortiGate must have local storage (disk) to store logs locally. It also must have connectivity to FortiCloud servers, and logging to FortiCloud must be enabled. The local disk logging is a separate configuration.

Answer

The FortiGate must be configured to log to both destinations simultaneously

Answer

The FortiGate must be in NAT mode

Answer

The FortiGate must have a policy to allow outbound traffic to FortiCloud

Question 6

A FortiGate HA cluster is running in active-passive mode with two units. The administrator notices that the primary unit fails over to the secondary unit every few minutes, causing service disruption. The heartbeat interfaces are configured on port1 and port2. What is the MOST likely cause of the frequent failovers?

Accepted Answer

The heartbeat interfaces are experiencing high packet loss. In an active-passive FortiGate HA cluster, the primary and secondary units continuously exchange FGCP heartbeats over the configured heartbeat interfaces (port1 and port2). If those links experience packet loss — due to duplex mismatch, cabling issues, or a flapping switch port — the secondary stops receiving heartbeats and triggers a failover. Frequent, periodic failovers every few minutes are the classic symptom of intermittent heartbeat loss rather than a configuration error.

Answer

Session synchronization is consuming too much bandwidth

Answer

The HA priority is set to 0 on the primary unit

Answer

The HA override setting is enabled, causing the secondary to take over

Question 7

A FortiGate administrator needs to capture packets on the DMZ interface to troubleshoot a connectivity issue. Which CLI command should be used to start a packet capture?

Accepted Answer

diagnose sniffer packet. The correct CLI command to start a packet capture on a FortiGate is 'diagnose sniffer packet'. This command allows you to capture packets on a specific interface with various filters and verbosity levels. It is the standard tool for troubleshooting connectivity issues at the packet level.

Answer

diagnose debug flow

Answer

diagnose sys session list

Answer

execute packet-capture start

Question 8

An administrator configures a FortiGate HA cluster in active-active mode. After enabling session synchronization, they notice that new sessions are not being synced to the secondary unit. The cluster is using a dedicated heartbeat interface. What could be the reason?

Accepted Answer

The firewall policy does not have session sync enabled. In active-active HA, session synchronization requires that the session sync flag is enabled on the firewall policy. Without it, sessions are not synced.

Answer

The HA mode is set to active-passive

Answer

The session TTL is too short

Answer

The heartbeat interface is not configured with an IP address

Question 9

An administrator runs 'diagnose debug flow' for a specific policy and sees the following output:
id=20085 trace_id=10 func=vf_ip_route_in msg='No matching interface to route packet'
What does this indicate?

Accepted Answer

The destination IP address has no matching route in the routing table. The trace indicates that FortiGate cannot find a route to forward the packet, meaning the destination is unreachable.

Answer

The packet is being blocked by a firewall policy

Answer

The source interface is down

Answer

The session table is full

Question 10

What is the purpose of the 'override' setting in FortiGate HA?

Accepted Answer

It enables the higher-priority unit to reclaim the primary role after recovery. The 'override' setting in FortiGate HA allows a higher-priority unit to reclaim the primary role after it recovers from a failure. Without override, the primary role does not automatically revert to the original unit even if it comes back online with a higher priority. This ensures predictable failback behavior.

Answer

It allows management access to the cluster via a virtual IP

Answer

It disables HA failover during maintenance windows

Answer

It forces the secondary unit to become primary immediately

Question 11

A FortiGate administrator needs to send logs to a FortiAnalyzer device for long-term storage and analysis. Which log configuration must be set up?

Accepted Answer

Add the FortiAnalyzer as a logging destination in Log Settings. To send logs to FortiAnalyzer, the administrator must add FortiAnalyzer as a logging destination in the FortiGate's Log Settings (under Log & Report > Log Settings or via CLI 'config log fortianalyzer setting'). This enables the FortiGate to forward logs to the FortiAnalyzer IP address for storage and analysis.

Answer

Configure an IPsec tunnel to FortiAnalyzer

Answer

Enable disk logging on the FortiGate

Answer

Configure syslog server pointing to FortiAnalyzer IP

Question 12

What is the function of Zero Trust Network Access (ZTNA) on a FortiGate?

Accepted Answer

It allows users to securely access internal applications without a VPN, based on identity and device posture. ZTNA on FortiGate provides secure, identity-based access to internal applications without requiring a traditional VPN tunnel. It evaluates user identity and device posture before granting access, ensuring that only authorized users and compliant devices can reach specific applications. This aligns with the Zero Trust principle of 'never trust, always verify' and is implemented via FortiGate's ZTNA features, often integrated with FortiClient and FortiAuthenticator.

Answer

It replaces the firewall policy for all traffic

Answer

It encrypts all traffic between the FortiGate and the internet

Answer

It is a cloud-based subscription for antivirus updates

Question 13

A FortiGate cluster is configured in active-passive HA. The administrator wants to manage the cluster using a single IP address that always points to the current primary unit. Which configuration should be applied?

Accepted Answer

Enable 'management IP' under HA configuration with the desired IP. The management interface in HA can have a virtual IP that follows the primary unit, accessible via the floating (virtual) management IP.

Answer

Configure a virtual IP (VIP) for HTTPS management

Answer

Set the HA management IP as a dedicated interface IP on each unit

Answer

Use the same IP address on both units and disable ARP

Question 14

A FortiGate receives log messages with severity 'warning'. What is the log severity level number for 'warning' according to FortiGate's log severity levels?

Accepted Answer

4. FortiGate severity levels: Emergency=0, Alert=1, Critical=2, Error=3, Warning=4, Notification=5, Information=6, Debug=7.

Answer

3

Answer

6

Answer

5

Question 15

An administrator is troubleshooting a FortiGate that is not sending logs to FortiCloud. The FortiGate has internet connectivity and a valid FortiCloud subscription. Which THREE steps should the administrator take to resolve this issue? (Select three.)

Accepted Answer

Ensure that the log types (traffic, event, security) are enabled for FortiCloud. Option A is correct because FortiCloud log forwarding only transmits the log categories that are explicitly enabled under Log & Report > Log Settings > FortiCloud, so traffic, event, and security logs must each be turned on for them to be uploaded. Option B is correct because the dashboard FortiCloud widget shows the registration/entitlement status and whether the FortiGate is successfully connected to FortiCloud, which is the fastest way to confirm the subscription is actually active on the device. Option C is correct because the FortiGate must resolve the FortiCloud FQDN (for example, the service endpoint such as fortigate.forticloud.com or the region-specific logging endpoint) via DNS; if name resolution fails, logs cannot be sent even with working internet and a valid subscription. Option D is incorrect because increasing the log buffer size only affects local disk/memory log retention and does not fix FortiCloud delivery. Option E is incorrect because disabling an antivirus profile has no bearing on log transmission and would only weaken security.

Answer

Increase the log buffer size

Answer

Disable the antivirus profile temporarily