NSE4 High Availability and Diagnostics Practice Test 7 — 15 Questions

Question 1

A FortiGate admin runs 'diagnose sys session filter dport 443' and then 'diagnose sys session list'. The output shows a session with 'proto=6 proto_state=01 duration=3600 expire=3599'. What does this indicate about the session?

Accepted Answer

The session is in a half-open state, waiting for SYN-ACK. Protocol 6 is TCP, proto_state=01 indicates TCP SYN_SENT state (the first step of the three-way handshake). Duration and expire are in seconds. The session has been open for 3600 seconds (1 hour) and will expire in 3599 seconds, which is unusual for a TCP session that should have completed handshake quickly. This suggests the session is stuck in SYN_SENT, likely due to no SYN-ACK response.

Answer

The session is closing with a FIN flag

Answer

The session is fully established and transferring data

Answer

The session was blocked by a firewall policy

Question 2

An administrator is configuring an active-passive HA cluster and wants to ensure that the secondary unit can be monitored and managed directly via HTTPS even when it is not the primary. Which setting must be enabled?

Accepted Answer

Enable 'set management-ip' on the HA configuration. In active-passive HA, the management interface allows individual management of each unit. Enabling 'management interface' on a dedicated interface (or a VLAN) gives each unit its own IP address for out-of-band management, independent of the HA cluster IP.

Answer

Use the same IP address for both units with different ports

Answer

Configure a virtual IP address for management in the firewall policy

Answer

Set 'ha-mgmt-status enable' on the interface

Question 3

A FortiGate admin is troubleshooting intermittent VPN disconnections. The admin enables debug flow with 'diagnose debug flow filter daddr 10.0.0.1' and 'diagnose debug flow trace start 10'. The output shows 'msg: send to x.x.x.x via intf port1' but then immediately 'msg: no matching policy'. However, the firewall policy list shows a policy that should match. What is the most likely cause?

Accepted Answer

A static route is missing or incorrect, causing the traffic to exit the wrong interface. The 'no matching policy' message indicates that the traffic did not match any policy. Since the debug shows the traffic is going out via port1, but the policy might be configured on a different interface (e.g., the VPN interface). In a VPN scenario, traffic destined for the remote subnet must match a policy from the VPN tunnel interface to the destination. If the traffic is being routed out port1 (the physical WAN) instead of through the VPN tunnel, the policy check fails. This is often due to missing or incorrect routing. Alternatively, the policy might be correctly configured but the traffic is being processed on the wrong VDOM, but the routing issue is more common.

Answer

The policy's source interface is not the incoming interface

Answer

The firewall policy is disabled

Answer

The VPN tunnel is down

Question 4

An administrator needs to ensure that in an active-passive HA cluster, the primary unit always remains the preferred master unless it fails, regardless of other factors. The administrator sets the primary's HA priority to 200 and the secondary to 100. However, after a reboot of the primary, the secondary becomes the primary. What additional step is required?

Accepted Answer

Set 'set override enable' under config system ha. In HA, the 'override' setting (or 'set override enable') ensures that when the primary recovers, it will preempt the current primary and become active again. Without override, the cluster uses a non-preemptive mode: once a unit becomes primary, it stays primary even if a higher-priority unit comes back online.

Answer

Set 'set ha-mgmt-status enable' on the primary

Answer

Reduce the secondary priority to 0

Answer

Increase the primary priority to 255

Question 5

A network admin receives an alert that the FortiGate disk logs are no longer being written. The admin checks the disk status and sees that the disk is full. However, the admin needs to preserve the logs for compliance purposes. Which action should the admin take to continue logging while preserving the existing logs?

Accepted Answer

Configure log upload to FortiAnalyzer and manually archive current logs, then clear the local disk. FortiGate allows log rotation and archiving. The admin can configure the log settings to compress old logs or move them to an external location (like FortiAnalyzer or FortiCloud). However, the immediate need is to free space on the disk. The best practice is to archive existing logs to an external server and then clear the local disk, or enable automatic upload to FortiAnalyzer. The options are evaluated: Option D is the correct action because it preserves logs by uploading them to FortiAnalyzer, then clearing disk space to continue logging.

Answer

Increase the log disk quota to allow more logs

Answer

Delete all logs from the disk and restart logging

Answer

Compress the existing log files and set a higher compression level for future logs

Question 6

An administrator wants to monitor real-time traffic flows on a FortiGate, specifically to see packet details for traffic matching certain criteria. Which command should the administrator use to capture live packets on an interface?

Accepted Answer

diagnose sniffer packet. The 'diagnose sniffer packet' command is the built-in packet capture tool on FortiGate. It allows capturing packets on interfaces with filters for IP, port, protocol, etc. Example: 'diagnose sniffer packet any "host 10.0.0.1" 4'.

Answer

diagnose debug enable and diagnose debug flow trace

Answer

diagnose sys session list

Answer

execute system grep from CLI

Question 7

An administrator is troubleshooting a slow web application. The admin suspects that the FortiGate's session table might be full, causing new sessions to be dropped. Which command should the admin use to check the current session table utilization?

Accepted Answer

diagnose sys session stat. The 'diagnose sys session stat' command displays statistics about the session table, including the number of current sessions and the maximum allowed. This helps determine if the session table is near capacity.

Answer

get system performance status

Answer

diagnose sys session list

Answer

diagnose sys session filter

Question 8

A company has two FortiGate units in an active-active HA cluster. They want to ensure that sessions initiated from the internet through a virtual IP are synchronized to the peer unit in case of failover. Which HA setting is required?

Accepted Answer

Enable 'session-pickup' under config system ha. In active-active HA, session synchronization is enabled by default for TCP sessions, but for UDP and other protocols, session sync needs to be explicitly enabled. However, the question is about ensuring sessions are synchronized. The key setting is 'session-pickup' which enables session synchronization for all protocols. Also, for active-active, 'session-pickup-connectionless' should be enabled for UDP and ICMP. But the most direct answer is to enable session-pickup globally.

Answer

Enable 'set ha-mgmt-status enable' on the WAN interface

Answer

Set 'set schedule' to 'round-robin' for the VIP

Answer

Configure the same virtual IP on both units

Question 9

An administrator needs to send logs from a FortiGate to a remote FortiAnalyzer for centralized log storage and analysis. Which configuration step is required on the FortiGate?

Accepted Answer

Set the FortiAnalyzer as the log destination in Log Settings. To send logs to FortiAnalyzer, the administrator must configure the FortiAnalyzer as a remote log destination under Log Settings. This is done via 'config log fortianalyzer setting' and specifying the server IP and other parameters.

Answer

Configure a firewall policy allowing traffic from FortiGate to FortiAnalyzer on port 514

Answer

Create a log forwarding rule to forward all logs to the FortiAnalyzer

Answer

Install a FortiGate connector on the FortiAnalyzer

Question 10

A FortiGate is configured with an active-passive HA cluster. The admin notices that when the primary unit fails, the secondary takes over, but after the primary recovers, it does not automatically become active again. What is the most likely reason?

Accepted Answer

Override is not enabled. By default, HA does not preempt. The 'override' setting is disabled. When the primary recovers, it does not force a failback because the cluster is non-preemptive. The admin must enable override if they want automatic failback.

Answer

The primary has a lower priority than the secondary

Answer

Session pickup is disabled

Answer

The heartbeat interface is down

Question 11

An admin is troubleshooting why a user's traffic is not being logged. The firewall policy has logging enabled at 'All Sessions'. The admin checks the traffic log and sees no entries for that user. The admin runs 'diagnose debug flow' and sees the traffic is matching the policy. What could be the issue?

Accepted Answer

The log queue is overflowing and logs are being dropped. If the traffic is matching the policy but not appearing in logs, the most common reason is that the log buffer is full or logs are being dropped due to high rate. Alternatively, the log device (e.g., disk) might be full or the log queue is overflowing. Another possibility is that the log severity filter is too restrictive, but by default traffic logs are logged at 'information' severity. The scenario says logging is enabled, so the issue is likely log buffer overflow or disk full. Option D addresses log disk space or buffer overflow.

Answer

The user's traffic is not traversing the FortiGate

Answer

The logging filter is set to only log 'emergency' severity

Answer

The log disk is full and cannot accept new logs

Question 12

An administrator is configuring ZTNA (Zero Trust Network Access) on a FortiGate. The administrator needs to ensure that only clients with a valid posture assessment can access an internal application. Which access proxy setting must be configured to enforce this requirement?

Accepted Answer

Configure a ZTNA rule with a ZTNA tag requirement. ZTNA uses access proxies to secure access. To enforce client posture assessment, the administrator needs to configure an access proxy with a ZTNA rule that includes a ZTNA tag matching the required posture. The tag is assigned by FortiClient EMS based on compliance. The access proxy rule can then require that the client presents a valid ZTNA tag.

Answer

Enable SSL deep inspection on the access proxy

Answer

Set the access proxy to use certificate-based authentication

Answer

Enable multi-factor authentication on the access proxy

Question 13

An administrator is setting up an active-passive HA pair and wants to ensure that the cluster can properly monitor each unit's health. Which TWO interfaces must be configured as HA heartbeat interfaces? (Choose two.)

Accepted Answer

A VLAN interface on a dedicated trunk that is only used for HA. Heartbeat interfaces are used for cluster communication and health monitoring. FortiGate requires at least one dedicated heartbeat interface, but best practice is to have two for redundancy. The heartbeat interfaces can be physical interfaces or VLANs. They should be dedicated to HA traffic and not carry regular data traffic. Options: The correct ones are physical or VLAN interfaces designated as heartbeat. Option C and D are correct because heartbeat interfaces can be any unused interface, and they should not carry data traffic. Option A is wrong because management interfaces are separate. Option B is wrong because the WAN interface is typically used for data. Option E is wrong because the internal switch interface is usually for LAN traffic.

Answer

The internal switch interface (e.g., port3)

Answer

The WAN interface (port1)

Answer

The management interface

Question 14

An administrator is troubleshooting an issue where users cannot access an internal web server via the internet through a FortiGate. The FortiGate has a virtual IP (VIP) configured for the web server. The administrator runs 'diagnose debug flow filter daddr <public-ip>' and 'diagnose debug flow trace start 100'. The output shows 'msg: forward to x.x.x.x via intf port2' but then 'msg: policy deny'. Which TWO actions should the administrator take to resolve the issue? (Choose two.)

Accepted Answer

Confirm that the firewall policy's destination is set to the internal web server's IP address (or the VIP's mapped IP). The debug shows that traffic is being forwarded to the internal server (via port2) but then denied by policy. This means the traffic is matching the VIP and being DNATed, but the firewall policy that should allow the traffic is either missing, disabled, or configured incorrectly. The administrator should check the firewall policy that handles the traffic after DNAT. Common issues: the policy's source interface is not the incoming interface (should be the WAN interface), or the policy's destination is not the internal server's IP (should be the original destination or the VIP destination). Option A and D are correct: ensure the policy has the correct source interface (WAN) and that the destination is set to the VIP's mapped IP (or the VIP itself). Option B is wrong because the issue is not DNS. Option C is wrong because adding a route to the internet won't help. Option E is wrong because the VIP is already configured.

Answer

Ensure that a static route exists to the internet via the WAN interface

Answer

Check if the public DNS resolution for the domain is correct

Answer

Recreate the virtual IP object with a different port

Question 15

A FortiGate administrator is configuring logging to meet a compliance requirement that all security events must be stored for at least one year. The FortiGate has limited local disk space. Which THREE actions should the administrator take to meet this requirement? (Choose three.)

Accepted Answer

Configure log rolling and retention policies to automatically delete older logs from the local disk after a set period. To store logs for a year with limited local disk, the administrator needs to offload logs to an external storage solution such as FortiAnalyzer or FortiCloud, and also set appropriate log retention policies. The correct actions are: enable logging to FortiAnalyzer (A), enable logging to FortiCloud (C), and configure log rolling and retention to automatically delete old logs from local disk (E). Option B is wrong because increasing log severity to only 'emergency' would lose most logs. Option D is wrong because disabling disk logs would avoid local storage but without external logging, logs would be lost.

Answer

Set the log severity filter to only log 'emergency' events to reduce volume

Answer

Disable local disk logging to save space