NSE4 High Availability and Diagnostics Practice Test 8 — 15 Questions

Question 1

A FortiGate administrator is troubleshooting an issue where internal users cannot access a public web server. The administrator runs 'diagnose debug flow' and sees the output shows 'forward to port2' but then 'no route to host'. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The FortiGate does not have a route to the destination IP. The debug flow output shows 'forward to port2' but then 'no route to host'. This indicates that the packet is being forwarded to the correct outgoing interface (port2) but the FortiGate does not have a route to the destination IP address in its routing table, so the packet cannot be forwarded further. Therefore, the most likely cause is that the FortiGate lacks a route to the destination IP, which corresponds to Option C.

Answer

The source IP is not in the routing table

Answer

The interface port2 is down

Answer

The destination port is blocked by a firewall policy

Question 2

Which log severity level indicates that a log message is for informational purposes and does not require immediate action?

Accepted Answer

Information. In FortiGate, log severity levels follow the standard syslog severity: 0=emergency, 1=alert, 2=critical, 3=error, 4=warning, 5=notice, 6=informational, 7=debug. Informational (level 6) is used for informational messages that do not require immediate action. Option A (Notice) is level 5, which indicates normal but significant conditions. Option B (Debug) is level 7, used for debugging information. Option D (Warning) is level 4, indicating a warning condition.

Answer

Notice

Answer

Debug

Answer

Warning

Question 3

A FortiGate administrator is configuring ZTNA (Zero Trust Network Access) to secure access to an internal application. Which two components must be configured to create a ZTNA rule? (Choose two.)

Accepted Answer

ZTNA gateway. Options B and D are correct. ZTNA rules require a ZTNA gateway (the FortiGate acting as proxy) and a ZTNA application (the internal resource). The rule maps external access to the internal application via the gateway.

Answer

ZTNA tag

Answer

VPN tunnel

Answer

SSL certificate

Question 4

An administrator wants to view real-time debug output for traffic flowing through a FortiGate. Which command should they use to enable flow tracing with a specific source IP filter?

Accepted Answer

diagnose debug flow filter src. The command 'diagnose debug flow filter src' sets a source IP filter for flow debugging, allowing real-time debug output for traffic from a specific source IP. 'diagnose debug enable' enables debug output but does not set filters; 'diagnose sys session filter src' filters session table listings, not flow traces; 'diagnose sniffer packet filter src' sets a filter for packet sniffing, not flow tracing.

Answer

diagnose debug enable

Answer

diagnose sys session filter src

Answer

diagnose sniffer packet filter src

Question 5

In a FortiGate HA cluster, the administrator wants to reduce failover time when the primary unit fails. Which two adjustments can help achieve this? (Choose two.)

Accepted Answer

Decrease the 'set ha-heartbeat-interval' value. Options A and D are correct. Decreasing the 'set ha-heartbeat-interval' value increases the frequency of heartbeat messages, allowing faster failure detection. Decreasing the 'set ha-failover-threshold' value reduces the number of missed heartbeats required to trigger a failover, further shortening detection time. Option B (increasing session-pickup-delay) would delay session synchronization and increase failover time, so it is incorrect.

Answer

Increase the 'set session-pickup-delay' value

Answer

Enable 'set ha-arp-interval'

Answer

Increase the 'set ha-heartbeat-interval' value

Question 6

A FortiGate administrator is troubleshooting a VPN tunnel that is not establishing. The administrator wants to view the IKE debug output in real time. Which command should they use?

Accepted Answer

diagnose debug application ike -1. 'diagnose debug application ike -1' enables IKE debug with verbosity level -1 (all messages). This is the standard command for debugging IPsec IKE negotiations.

Answer

diagnose debug flow filter dport 500

Answer

diagnose sniffer packet any "udp port 500"

Answer

diagnose debug application ipsec -1

Question 7

An administrator wants to send logs from a FortiGate to an external syslog server. Which log forwarding method should they configure?

Accepted Answer

Syslog. FortiGate supports sending logs to an external syslog server via 'config log syslogd setting'.

Answer

SMTP

Answer

NetFlow

Answer

SNMP

Question 8

A FortiGate administrator is setting up an HA cluster with two FortiGates. The heartbeat interfaces are connected via a dedicated switch. The administrator wants to ensure that the management IP is always accessible through the active unit. Which configuration is required?

Accepted Answer

Configure 'set management-ip' under the HA interface configuration. In HA, the management interface IP must be configured on the HA interface or as a dedicated management interface. Setting 'set management-ip' on the HA interface ensures the management IP is always on the active unit.

Answer

Configure a virtual IP address for the management interface

Answer

Set the management IP on each unit separately

Answer

Use the same IP address on both units

Question 9

An administrator wants to view the current session table on a FortiGate. Which command should they use?

Accepted Answer

diagnose sys session list. 'diagnose sys session list' displays the current session table, showing all active sessions.

Answer

diagnose debug flow

Answer

show full-configuration

Answer

get system performance statistics

Question 10

A FortiGate administrator notices that the HA cluster is frequently failing over even though no hardware failure has occurred. The heartbeat link shows some packet loss. What is the best action to reduce unnecessary failovers?

Accepted Answer

Increase the failover threshold. Increasing the failover threshold (the number of missed heartbeats before triggering failover) makes the cluster more tolerant to temporary heartbeat loss, reducing false failovers.

Answer

Lower the heartbeat interval

Answer

Change HA mode to active-active

Answer

Disable session synchronization

Question 11

Which of the following FortiGate log types records information about user authentication and administrative access?

Accepted Answer

Event logs. Event logs record system events such as user authentication, admin logins, and configuration changes.

Answer

Traffic logs

Answer

System logs

Answer

Security logs

Question 12

An administrator needs to store logs for compliance purposes and wants them to be retained even if the FortiGate is reset. Which log storage option should they use?

Accepted Answer

FortiAnalyzer. FortiAnalyzer provides centralized log storage separate from the FortiGate, ensuring logs are retained even if the FortiGate is reset.

Answer

FortiCloud logs

Answer

Syslog server

Answer

Local disk logs

Question 13

In an active-passive HA cluster, the administrator wants to ensure that new connections are load-balanced across both units only for specific services while maintaining failover capability. Which configuration should be applied?

Accepted Answer

Change HA mode to active-active. In an active-passive HA cluster, only one unit actively handles traffic while the other remains on standby. To load-balance new connections across both units, the cluster must be configured in active-active mode. Active-active mode allows both units to process traffic simultaneously, distributing new sessions based on load-balance scheduling. Option D is incorrect because 'load-balance-schedule' is only applicable in active-active mode; enabling it on the HA interface in active-passive mode will not achieve load balancing across both units.

Answer

Set 'set ha-priority' to 100 on both units

Answer

Configure virtual IPs for each service

Answer

Enable 'set load-balance-schedule' on the HA interface

Question 14

A FortiGate administrator is diagnosing a performance issue. They notice that the CPU usage is consistently high. Which command can provide a real-time view of the processes consuming CPU?

Accepted Answer

diagnose sys top. 'diagnose sys top' provides a real-time top-like view of processes and their CPU/memory usage, helpful for identifying resource hogs.

Answer

get system performance status

Answer

diagnose sys session stat

Answer

diagnose debug flow

Question 15

An administrator wants to ensure that log messages are categorized by severity and that only events with severity 'error' and above are sent to the syslog server. Which configuration should be used?

Accepted Answer

Set 'set severity error' in syslog config. In syslog settings, 'set severity' defines the minimum severity level to send. Setting it to 'error' includes error, critical, alert, and emergency messages.

Answer

Set 'set severity critical' in syslog config

Answer

Set 'set severity warning' in syslog config

Answer

Set 'set severity alert' in syslog config