NSE4 High Availability and Diagnostics Practice Test 7 — 15 Questions

Question 1

A company has two FortiGate units in an active-active HA cluster. They want to ensure that sessions initiated from the internet through a virtual IP are synchronized to the peer unit in case of failover. Which HA setting is required?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable 'session-pickup' under config system ha. In active-active HA, session synchronization is enabled by default for TCP sessions, but for UDP and other protocols, session sync needs to be explicitly enabled. However, the question is about ensuring sessions are synchronized. The key setting is 'session-pickup' which enables session synchronization for all protocols. Also, for active-active, 'session-pickup-connectionless' should be enabled for UDP and ICMP. But the most direct answer is to enable session-pickup globally.

Answer

Enable 'set ha-mgmt-status enable' on the WAN interface

Answer

Set 'set schedule' to 'round-robin' for the VIP

Answer

Configure the same virtual IP on both units

Question 2

An administrator needs to send logs from a FortiGate to a remote FortiAnalyzer for centralized log storage and analysis. Which configuration step is required on the FortiGate?

Accepted Answer

Set the FortiAnalyzer as the log destination in Log Settings. To send logs to FortiAnalyzer, the administrator must configure the FortiAnalyzer as a remote log destination under Log Settings. This is done via 'config log fortianalyzer setting' and specifying the server IP and other parameters.

Answer

Configure a firewall policy allowing traffic from FortiGate to FortiAnalyzer on port 514

Answer

Create a log forwarding rule to forward all logs to the FortiAnalyzer

Answer

Install a FortiGate connector on the FortiAnalyzer

Question 3

A FortiGate is configured with an active-passive HA cluster. The admin notices that when the primary unit fails, the secondary takes over, but after the primary recovers, it does not automatically become active again. What is the most likely reason?

Accepted Answer

Override is not enabled. By default, HA does not preempt. The 'override' setting is disabled. When the primary recovers, it does not force a failback because the cluster is non-preemptive. The admin must enable override if they want automatic failback.

Answer

The primary has a lower priority than the secondary

Answer

Session pickup is disabled

Answer

The heartbeat interface is down

Question 4

An admin is troubleshooting why a user's traffic is not being logged. The firewall policy has logging enabled at 'All Sessions'. The admin checks the traffic log and sees no entries for that user. The admin runs 'diagnose debug flow' and sees the traffic is matching the policy. What could be the issue?

Accepted Answer

The log queue is overflowing and logs are being dropped. The traffic matches the policy, so it is traversing the FortiGate, ruling out option A. The logging filter severity is not the issue because 'All Sessions' logs at 'information' severity by default. A full log disk (option D) would cause logs to be dropped, but the most common cause in this scenario is the log queue overflowing and dropping logs (option B). The FortiGate's log queue has a limited size; if logs are generated faster than they can be written to the disk, the queue overflows and logs are dropped, which is why traffic logs do not appear even though the policy matches.

Answer

The user's traffic is not traversing the FortiGate

Answer

The logging filter is set to only log 'emergency' severity

Answer

The log disk is full and cannot accept new logs

Question 5

An administrator is configuring ZTNA (Zero Trust Network Access) on a FortiGate. The administrator needs to ensure that only clients with a valid posture assessment can access an internal application. Which access proxy setting must be configured to enforce this requirement?

Accepted Answer

Configure a ZTNA rule with a ZTNA tag requirement. ZTNA uses access proxies to secure access. To enforce client posture assessment, the administrator needs to configure an access proxy with a ZTNA rule that includes a ZTNA tag matching the required posture. The tag is assigned by FortiClient EMS based on compliance. The access proxy rule can then require that the client presents a valid ZTNA tag.

Answer

Enable SSL deep inspection on the access proxy

Answer

Set the access proxy to use certificate-based authentication

Answer

Enable multi-factor authentication on the access proxy

Question 6

An administrator is setting up an active-passive HA pair and wants to ensure that the cluster can properly monitor each unit's health. Which TWO interfaces must be configured as HA heartbeat interfaces? (Choose two.)

Accepted Answer

A VLAN interface on a dedicated trunk that is only used for HA. Heartbeat interfaces are used for cluster communication and health monitoring. FortiGate requires at least one dedicated heartbeat interface, but best practice is to have two for redundancy. The heartbeat interfaces must be dedicated to HA traffic and should not carry regular data traffic. Option B is correct because a VLAN interface on a dedicated trunk used only for HA meets this requirement. Option C is correct because a dedicated physical interface not used for data traffic is the standard recommendation. Option A (internal switch interface) is wrong because it typically carries LAN traffic. Option D (WAN interface) is wrong because it carries data traffic. Option E (management interface) is wrong because it is used for administrative access, not HA heartbeats.

Answer

The internal switch interface (e.g., port3)

Answer

The WAN interface (port1)

Answer

The management interface

Question 7

An administrator is troubleshooting an issue where users cannot access an internal web server via the internet through a FortiGate. The FortiGate has a virtual IP (VIP) configured for the web server. The administrator runs 'diagnose debug flow filter daddr <public-ip>' and 'diagnose debug flow trace start 100'. The output shows 'msg: forward to x.x.x.x via intf port2' but then 'msg: policy deny'. Which TWO actions should the administrator take to resolve the issue? (Choose two.)

Accepted Answer

Confirm that the firewall policy's destination is set to the internal web server's IP address (or the VIP's mapped IP). Options C and D are correct. The debug output indicates that traffic is DNATed by the VIP and forwarded to the internal server (via port2), but then denied by a firewall policy. This means the firewall policy that should allow the traffic after DNAT is either missing or misconfigured. To resolve, the administrator must ensure that the firewall policy has the correct source interface (WAN) and that the destination is set to the internal web server's IP address (or the VIP's mapped IP). Option A is incorrect because a static route to the internet is not needed; the route to the internal server already exists via port2. Option B is incorrect because DNS resolution is not relevant to the policy deny. Option E is incorrect because the VIP is already correctly configured; the issue is with the firewall policy.

Answer

Ensure that a static route exists to the internet via the WAN interface

Answer

Check if the public DNS resolution for the domain is correct

Answer

Recreate the virtual IP object with a different port

Question 8

A FortiGate HA cluster is configured in active-passive mode with two units. The primary unit fails. The secondary unit takes over, but some established TCP sessions are dropped. What is the most likely cause?

Accepted Answer

Session synchronization is not enabled. Session synchronization must be enabled for sessions to be preserved during failover. Without session sync, the backup unit has no knowledge of existing sessions and drops them.

Answer

The HA failover threshold is set too high

Answer

The HA mode is active-passive

Answer

The heartbeat interface is down

Question 9

An administrator wants to troubleshoot a traffic flow issue on a FortiGate. They suspect packets are being dropped. Which command should they use to perform a real-time packet capture on an interface?

Accepted Answer

diagnose sniffer packet. The 'diagnose sniffer packet' command is used to capture packets in real time on FortiGate interfaces.

Answer

get system performance status

Answer

diagnose sys session list

Answer

diagnose debug flow

Question 10

A FortiGate administrator runs 'diagnose debug flow' with a filter for a specific source IP. The output shows 'no policy matched' for the traffic. The administrator verifies that a firewall policy exists with that source IP. What is the most likely reason for the 'no policy matched' message?

Accepted Answer

The traffic is being blocked by an implicit deny or a different policy before reaching the expected policy. Debug flow may show 'no policy matched' when traffic hits an implicit deny or a different policy before reaching the expected policy, such as due to policy order where an earlier policy with a broader match blocks it, or inter-VDOM routing issues. Option B is incorrect because the debug flow filter is working correctly—it matches the source IP; the issue is that no applicable policy is found for that traffic.

Answer

The firewall policy is disabled

Answer

The debug flow filter is not configured correctly

Answer

The source IP is not in the routing table

Question 11

A FortiGate HA cluster is set to active-active mode. The administrator notices that session synchronization is enabled but some sessions are not being synced between cluster units. Which of the following is a likely cause for incomplete session synchronization in active-active mode?

Accepted Answer

The 'set session-sync-id' is not configured or mismatched between cluster units. In active-active HA mode, session synchronization requires that the 'session-sync-id' be configured and match on all cluster units. If this ID is not set or mismatched, the cluster will not properly synchronize sessions. Option A is incorrect: unicast heartbeat affects heartbeat communication, not session sync. Option C is incorrect: heartbeat interface speed does not affect session synchronization. Option D is incorrect: HA override controls failover behavior, not session sync.

Answer

The cluster is using unicast heartbeat

Answer

The heartbeat interface speed is set to 1 Gbps

Answer

The HA override is enabled

Question 12

An administrator is reviewing log files on a FortiGate and needs to identify events related to a specific user authentication failure. The FortiGate has local disk logging enabled. Which command would the administrator use to search the logs for this event?

Accepted Answer

execute log filter. The 'execute log filter' command allows filtering logs by various criteria (user, type, etc.) before displaying them with 'execute log display', enabling the administrator to search for specific user authentication failure events.

Answer

diagnose debug authd fsrv record

Answer

show log traffic-log

Answer

get log traffic

Question 13

A FortiGate administrator receives an alert that the FortiGuard antivirus database on the firewall is outdated. Which subscription service must be active to update the antivirus signatures?

Accepted Answer

FortiGuard Antivirus Service. FortiGuard Antivirus Service provides signature updates for antivirus scanning. A valid subscription is required to download new antivirus signatures. The other services (IPS, Application Control, Web Filtering) provide different types of updates and do not update antivirus signatures.

Answer

FortiGuard IPS Service

Answer

FortiGuard Application Control Service

Answer

FortiGuard Web Filtering Service

Question 14

An administrator is configuring a FortiGate HA cluster and wants to ensure that the primary unit is always preferred based on its configuration priority. Which setting should be enabled to allow the primary unit to resume its role after a failover if it regains connectivity?

Accepted Answer

set override enable. The HA override setting allows a higher-priority unit to take over the primary role when it rejoins the cluster after a failure, even if it was previously secondary.

Answer

set ha-inherit-priority enable

Answer

set session-pickup enable

Answer

set ha-priority 255

Question 15

A FortiGate administrator runs 'diagnose sys session filter dport 443' followed by 'diagnose sys session list' and sees the following output for a session:
src=10.0.1.10 dst=192.168.2.20 sport=12345 dport=443 proto=6
vrf=0

What does the 'proto=6' indicate about this session?

Accepted Answer

The session is using TCP. The 'proto=6' in the session output indicates protocol number 6, which is assigned to TCP (Transmission Control Protocol) by the Internet Assigned Numbers Authority (IANA). Since the session is destined for port 443 (HTTPS), which typically uses TCP, this confirms the session is using TCP.

Answer

The session is using UDP

Answer

The session is using ESP

Answer

The session is using ICMP