NSE4 High Availability and Diagnostics Practice Test 8 — 15 Questions

Question 1

A FortiGate administrator needs to ensure that a specific traffic flow is fully inspected by the antivirus and IPS profiles. The traffic is HTTPS. Which THREE configuration items are required? (Select three.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Apply an IPS profile to the firewall policy. Option B is correct because an IPS profile must be attached to the firewall policy for the FortiGate to inspect the traffic flow for intrusions and exploits. Option C is correct because an antivirus profile must also be applied to the firewall policy so that the same traffic is scanned for malware and viruses. Option D is correct because the traffic is HTTPS, so SSL/TLS deep inspection must be enabled on the firewall policy to decrypt the traffic and allow the antivirus and IPS engines to inspect the payload. Option A is not required because flow-based inspection mode is a global inspection setting and is not a mandatory item for applying antivirus and IPS profiles to a specific HTTPS policy. Option E is not required because a DNS filter profile is used for DNS security filtering and does not enable antivirus or IPS inspection of HTTPS traffic.

Answer

Enable flow-based inspection mode globally

Answer

Configure a DNS filter profile

Question 2

A FortiGate HA cluster is operating in active-passive mode. The active unit fails over to the passive unit. After the failover, some existing TCP sessions are dropped. What is the MOST likely cause?

Accepted Answer

Session synchronization is not enabled or not working properly. In an active-passive FortiGate HA cluster, the passive unit only maintains existing TCP sessions if session synchronization (session-pickup) is enabled and functioning. When the active unit fails, the passive unit becomes active and must have the session state to continue forwarding packets for established connections. If session synchronization is not enabled or is broken (e.g., due to a misconfigured sync interface or high latency), the new active unit has no knowledge of existing sessions and drops them, forcing clients to re-establish connections. Thus, the most likely cause is that session synchronization is not enabled or not working properly.

Answer

The HA heartbeat interface has a high latency

Answer

The failover time is too slow, causing TCP timeouts

Answer

The TCP sessions are using NAT, which cannot be synchronized

Question 3

Which CLI command is used on a FortiGate to perform a real-time packet capture on an interface?

Accepted Answer

diagnose sniffer packet. On a FortiGate, the real-time packet capture command is 'diagnose sniffer packet '. It captures live packets on a specified interface with optional BPF-style filters and verbosity levels, making it the standard tool for troubleshooting traffic at the packet level. This is the FortiOS equivalent of tcpdump.

Answer

execute packet-capture

Answer

diagnose debug flow

Answer

diagnose sys session list

Question 4

A FortiGate administrator wants to ensure that in an active-passive HA cluster, a specific unit becomes the primary (active) unit after a reboot. Which configuration parameter should be set to a higher value on that unit?

Accepted Answer

HA priority. In a FortiGate active-passive HA cluster, the HA priority value determines which unit becomes the primary (active) unit. The unit with the higher priority value will be elected as the primary, provided that HA override is enabled. Therefore, setting a higher HA priority on the desired unit ensures it becomes active after a reboot.

Answer

HA session pickup delay

Answer

HA override

Answer

HA group-id

Question 5

Which FortiGate log type records user authentication events, such as successful logins and failed login attempts?

Accepted Answer

Event logs. Event logs on a FortiGate record system-level activities including user authentication events such as successful logins, failed login attempts, and administrative actions. These logs are specifically designed to capture events that are not traffic-related, making them the correct choice for authentication events.

Answer

ZTNA logs

Answer

Traffic logs

Answer

Security logs

Question 6

An administrator notices that traffic matching a firewall policy is not being logged. The policy has logging enabled. The FortiGate has local disk storage. What should the administrator check first?

Accepted Answer

The disk health and available space using 'diagnose sys disk' commands. When a FortiGate policy has logging enabled but logs are not appearing, and the device uses local disk storage, the first thing to check is whether the disk is healthy and has available space. FortiOS stops writing logs when the disk is full or failing, and 'diagnose sys disk' commands reveal disk health, usage, and log partition status. This is the most direct and common cause of missing local logs.

Answer

Whether the FortiGate has a valid FortiAnalyzer subscription

Answer

Whether FortiCloud logging is enabled

Answer

The log severity level on the policy

Question 7

In an active-active HA cluster, what is the purpose of the 'session sync' configuration?

Accepted Answer

To replicate session state so that if one unit fails, another can take over without interruption. Session sync ensures that sessions are shared between cluster units so that any unit can handle traffic for a given session.

Answer

To synchronize configuration changes between cluster members

Answer

To balance the number of sessions across cluster members

Answer

To synchronize the time between cluster members

Question 8

Which FortiGuard subscription service is required for URL filtering and web categorization?

Accepted Answer

FortiGuard Web Filtering. FortiGuard Web Filtering provides URL categorization and filtering capabilities.

Answer

FortiGuard IPS

Answer

FortiGuard Application Control

Answer

FortiGuard Antivirus

Question 9

A FortiGate administrator wants to configure Zero Trust Network Access (ZTNA) to secure access to an internal application. What is required on the FortiGate?

Accepted Answer

A ZTNA server and a ZTNA rule. FortiGate ZTNA requires configuring a ZTNA server (which defines the protected application, its real server, and the access proxy/certificate) and a ZTNA rule (which binds the server to users/groups and enforcement). Together they let the FortiGate act as an access proxy that authenticates users and brokers connections to the internal app without a full VPN tunnel.

Answer

A FortiClient EMS subscription

Answer

A VPN tunnel to the application

Answer

A firewall policy with SSL inspection enabled

Question 10

An administrator is configuring HA on two FortiGates. Both units have the same model and firmware. When they are connected, neither unit becomes active. The admin checks the HA status and sees that the cluster is not formed. What is the MOST likely cause?

Accepted Answer

The heartbeat interface is not configured. For a FortiGate HA cluster to form, the heartbeat interfaces must be properly configured and connected. The heartbeat interface is used for HA synchronization and monitoring between the units. If the heartbeat interface is not configured, the FortiGates cannot communicate, and the cluster will not form, leaving both units in a non-active state. Since both units have the same model and firmware, and the issue is that neither becomes active, the most likely cause is that the heartbeat interface is not configured.

Answer

The management interface is used as a heartbeat

Answer

The HA password is incorrect

Answer

The HA group-id does not match

Question 11

A FortiGate admin wants to send logs to both a local disk and a remote FortiAnalyzer. Which log configuration must be set?

Accepted Answer

Enable local logging and configure FortiAnalyzer as a remote server. To send logs to both local disk and a remote FortiAnalyzer, you must enable local logging (so logs are written to disk) and configure FortiAnalyzer as a remote logging server. FortiOS supports simultaneous local and remote logging when both are enabled; no special 'mirror' toggle is required for FortiAnalyzer in standard configurations. This combination satisfies the requirement of dual destinations.

Answer

Use the 'diagnose debug application log' command

Answer

Select 'Mirror local logs to FortiAnalyzer'

Answer

Set the log severity to 'Information' on both

Question 12

Which TWO of the following are valid methods to view real-time debug output on a FortiGate? (Choose two.)

Accepted Answer

diagnose sniffer packet. Diagnose debug flow and diagnose sniffer packet are real-time debug commands. Execute tail log is not a standard command.

Answer

diagnose debug enable

Answer

diagnose sys session list

Answer

execute tail log

Question 13

A FortiGate administrator is troubleshooting why traffic from a specific source IP is not being logged. The traffic is allowed by a firewall policy with logging enabled. Which TWO commands could the administrator use to verify if the traffic is hitting the expected policy? (Choose two.)

Accepted Answer

diagnose debug flow. Option B (diagnose debug flow) is correct because it traces a packet through the FortiGate's inspection path, showing which firewall policy matches the traffic and whether it is allowed or denied, which directly verifies if the source IP hits the expected policy. Option D (diagnose sys session filter src 10.0.0.1) is correct because it filters the session table by the source IP so the administrator can run 'diagnose sys session list' and confirm the session was created and which policy ID it matched. Option A (get system performance status) only shows CPU, memory, and uptime statistics and provides no policy-matching information. Option C (diagnose sniffer packet any 'host 10.0.0.1') captures raw packets but does not reveal which firewall policy processed them. Option E (diagnose debug application fnbamd) debugs the Fortinet non-blocking authentication daemon, which is unrelated to firewall policy matching for this traffic.

Answer

get system performance status

Answer

diagnose sniffer packet any 'host 10.0.0.1'

Answer

diagnose debug application fnbamd

Question 14

A FortiGate admin runs 'diagnose sys session filter dport 443' and then 'diagnose sys session list'. The output shows a session with 'proto=6 proto_state=01 duration=3600 expire=3599'. What does this indicate about the session?

Accepted Answer

The session is in a half-open state, waiting for SYN-ACK. Protocol 6 is TCP, proto_state=01 indicates TCP SYN_SENT state (the first step of the three-way handshake). Duration and expire are in seconds. The session has been open for 3600 seconds (1 hour) and will expire in 3599 seconds, which is unusual for a TCP session that should have completed handshake quickly. This suggests the session is stuck in SYN_SENT, likely due to no SYN-ACK response.

Answer

The session is closing with a FIN flag

Answer

The session is fully established and transferring data

Answer

The session was blocked by a firewall policy

Question 15

An administrator needs to ensure that in an active-passive HA cluster, the primary unit always remains the preferred master unless it fails, regardless of other factors. The administrator sets the primary's HA priority to 200 and the secondary to 100. However, after a reboot of the primary, the secondary becomes the primary. What additional step is required?

Accepted Answer

Set 'set override enable' under config system ha. In HA, the 'override' setting (or 'set override enable') ensures that when the primary recovers, it will preempt the current primary and become active again. Without override, the cluster uses a non-preemptive mode: once a unit becomes primary, it stays primary even if a higher-priority unit comes back online.

Answer

Set 'set ha-mgmt-status enable' on the primary

Answer

Reduce the secondary priority to 0

Answer

Increase the primary priority to 255