NSE4 High Availability and Diagnostics Practice Test 8 — 15 Questions

Question 1

A FortiGate HA cluster is configured in active-passive mode with two units. The primary unit fails. The secondary unit takes over, but some established TCP sessions are dropped. What is the most likely cause?

Accepted Answer

Session synchronization is not enabled. Option D is correct because session synchronization must be enabled for sessions to be preserved during failover. Without session sync, the backup unit has no knowledge of existing sessions and drops them.

Answer

The HA failover threshold is set too high

Answer

The HA mode is active-passive

Answer

The heartbeat interface is down

Question 2

An administrator wants to troubleshoot a traffic flow issue on a FortiGate. They suspect packets are being dropped. Which command should they use to perform a real-time packet capture on an interface?

Accepted Answer

diagnose sniffer packet. Option A is correct. The 'diagnose sniffer packet' command is used to capture packets in real time on FortiGate interfaces.

Answer

get system performance status

Answer

diagnose sys session list

Answer

diagnose debug flow

Question 3

A FortiGate administrator runs 'diagnose debug flow' with a filter for a specific source IP. The output shows 'no policy matched' for the traffic. The administrator verifies that a firewall policy exists with that source IP. What is the most likely reason for the 'no policy matched' message?

Accepted Answer

The traffic is being blocked by an implicit deny or a different policy before reaching the expected policy. Option B is correct. Debug flow may show 'no policy matched' when traffic hits an implicit deny before reaching the explicit policy, e.g., due to inter-VDOM routing or policy order where an earlier policy with a broader match blocks it.

Answer

The firewall policy is disabled

Answer

The debug flow filter is not configured correctly

Answer

The source IP is not in the routing table

Question 4

A FortiGate HA cluster is set to active-active mode. The administrator notices that session synchronization is enabled but some sessions are not being synced between cluster units. Which of the following is a likely cause for incomplete session synchronization in active-active mode?

Accepted Answer

The 'set session-sync-id' is not configured or mismatched between cluster units. Option A is correct. In active-active HA, session synchronization must be set to 'all' or 'group' to sync sessions; the default may only sync specific sessions. The 'session-sync-id' must match on all units.

Answer

The cluster is using unicast heartbeat

Answer

The heartbeat interface speed is set to 1 Gbps

Answer

The HA override is enabled

Question 5

An administrator is reviewing log files on a FortiGate and needs to identify events related to a specific user authentication failure. The FortiGate has local disk logging enabled. Which command would the administrator use to search the logs for this event?

Accepted Answer

execute log filter. Option D is correct. The 'execute log filter' command allows filtering logs by various criteria (user, type, etc.) before displaying them with 'execute log display'.

Answer

diagnose debug authd fsrv record

Answer

show log traffic-log

Answer

get log traffic

Question 6

A FortiGate administrator receives an alert that the FortiGuard antivirus database on the firewall is outdated. Which subscription service must be active to update the antivirus signatures?

Accepted Answer

FortiGuard Antivirus Service. Option B is correct. The FortiGuard Antivirus Service (AV) provides signature updates for antivirus scanning. Without a valid subscription, updates fail.

Answer

FortiGuard IPS Service

Answer

FortiGuard Application Control Service

Answer

FortiGuard Web Filtering Service

Question 7

An administrator is configuring a FortiGate HA cluster and wants to ensure that the primary unit is always preferred based on its configuration priority. Which setting should be enabled to allow the primary unit to resume its role after a failover if it regains connectivity?

Accepted Answer

set override enable. Option C is correct. The HA override setting allows a higher-priority unit to take over the primary role when it rejoins the cluster after a failure, even if it was previously secondary.

Answer

set ha-inherit-priority enable

Answer

set session-pickup enable

Answer

set ha-priority 255

Question 8

A FortiGate administrator runs 'diagnose sys session filter dport 443' followed by 'diagnose sys session list' and sees the following output for a session:
src=10.0.1.10 dst=192.168.2.20 sport=12345 dport=443 proto=6
vrf=0

What does the 'proto=6' indicate about this session?

Accepted Answer

The session is using TCP. Option D is correct. Protocol number 6 is TCP. The session is a TCP session to port 443 (HTTPS).

Answer

The session is using UDP

Answer

The session is using ESP

Answer

The session is using ICMP

Question 9

A FortiGate administrator is troubleshooting an issue where internal users cannot access a public web server. The administrator runs 'diagnose debug flow' and sees the output shows 'forward to port2' but then 'no route to host'. What is the most likely cause?

Accepted Answer

The FortiGate does not have a route to the destination IP. Option A is correct. 'No route to host' indicates that the FortiGate does not have a route to the destination IP in the routing table. The packet is being forwarded to the correct interface (port2) but then cannot be routed further.

Answer

The source IP is not in the routing table

Answer

The interface port2 is down

Answer

The destination port is blocked by a firewall policy

Question 10

Which log severity level indicates that a log message is for informational purposes and does not require immediate action?

Accepted Answer

Information. Option B is correct. In FortiGate, log severity levels follow the standard syslog severity: 0=emergency, 1=alert, 2=critical, 3=error, 4=warning, 5=notice, 6=informational, 7=debug. Informational is level 6.

Answer

Notice

Answer

Debug

Answer

Warning

Question 11

A FortiGate administrator is configuring ZTNA (Zero Trust Network Access) to secure access to an internal application. Which two components must be configured to create a ZTNA rule? (Choose two.)

Accepted Answer

ZTNA gateway. Option C and D are correct. ZTNA rules require a ZTNA gateway (the FortiGate acting as proxy) and a ZTNA application (the internal resource). The rule maps external access to the internal application via the gateway.

Answer

ZTNA tag

Answer

VPN tunnel

Answer

SSL certificate

Question 12

An administrator wants to view real-time debug output for traffic flowing through a FortiGate. Which command should they use to enable flow tracing with a specific source IP filter?

Accepted Answer

diagnose debug flow filter src. Option D is correct. 'diagnose debug flow' with 'filter src' sets a source IP filter for flow debugging.

Answer

diagnose debug enable

Answer

diagnose sys session filter src

Answer

diagnose sniffer packet filter src

Question 13

In a FortiGate HA cluster, the administrator wants to reduce failover time when the primary unit fails. Which two adjustments can help achieve this? (Choose two.)

Accepted Answer

Decrease the 'set ha-heartbeat-interval' value. Options A and B are correct. Decreasing the heartbeat interval (how often heartbeats are sent) and decreasing the failover threshold (number of missed heartbeats before failover) both reduce the time to detect failure and trigger failover.

Answer

Increase the 'set session-pickup-delay' value

Answer

Enable 'set ha-arp-interval'

Answer

Increase the 'set ha-heartbeat-interval' value

Question 14

A FortiGate administrator is troubleshooting a VPN tunnel that is not establishing. The administrator wants to view the IKE debug output in real time. Which command should they use?

Accepted Answer

diagnose debug application ike -1. Option A is correct. 'diagnose debug application ike -1' enables IKE debug with verbosity level -1 (all messages). This is the standard command for debugging IPsec IKE negotiations.

Answer

diagnose debug flow filter dport 500

Answer

diagnose sniffer packet any "udp port 500"

Answer

diagnose debug application ipsec -1

Question 15

An administrator wants to send logs from a FortiGate to an external syslog server. Which log forwarding method should they configure?

Accepted Answer

Syslog. Option A is correct. FortiGate supports sending logs to an external syslog server via 'config log syslogd setting'.

Answer

SMTP

Answer

NetFlow

Answer

SNMP