NSE4 High Availability and Diagnostics Practice Test 9 — 15 Questions

Question 1

In a FortiGate HA cluster, the administrator needs to perform a firmware upgrade without causing a full service outage. Which procedure should be followed?

Accepted Answer

Upgrade the secondary unit first, then perform a failover, then upgrade the primary unit. The recommended procedure to upgrade with minimal downtime is to upgrade the secondary unit first, then force a failover to make it primary, and then upgrade the former primary unit.

Answer

Upgrade the primary unit first, then the secondary unit

Answer

Disable HA and upgrade each unit separately

Answer

Upgrade both units simultaneously

Question 2

Which FortiGate feature allows administrators to verify if a specific IP address is being blocked by a security policy?

Accepted Answer

diagnose debug flow. 'diagnose debug flow' can trace a packet from a specific source IP and show whether it is allowed or denied by a firewall policy.

Answer

diagnose sys session list

Answer

get system ha status

Answer

diagnose sniffer packet

Question 3

A FortiGate administrator configures a ZTNA rule to protect an internal web server. The rule uses an access proxy. Which component on the FortiGate terminates the incoming ZTNA connection?

Accepted Answer

ZTNA gateway. The ZTNA gateway is the FortiGate component that terminates the incoming TLS connection from the client and proxies the request to the internal server.

Answer

ZTNA tag

Answer

SSL inspection profile

Answer

ZTNA application

Question 4

An administrator is troubleshooting a FortiGate that is not sending logs to FortiAnalyzer. The FortiAnalyzer is reachable from the FortiGate. Which command should the administrator use to test the connectivity and log forwarding?

Accepted Answer

execute log fortianalyzer test. The 'execute log fortianalyzer test' command sends a test log to FortiAnalyzer to verify connectivity and configuration, which is the appropriate troubleshooting step when the FortiAnalyzer is reachable but logs are not being forwarded.

Answer

execute log send

Answer

ping <FortiAnalyzer IP>

Answer

diagnose debug application fortianalyzer

Question 5

An administrator configures a FortiGate HA cluster in active-passive mode. After a failover, some UDP-based sessions are lost. What is the MOST likely reason?

Accepted Answer

UDP session synchronization is not enabled by default. UDP is stateless and not synchronized by default in active-passive HA unless session synchronization is configured. TCP sessions are synchronized by default.

Answer

The heartbeat interface failed

Answer

The failover triggered a routing table change

Answer

The HA priority was set too low on the backup unit

Question 6

An administrator wants to capture HTTP traffic on port1 for troubleshooting. Which CLI command should be used?

Accepted Answer

diagnose sniffer packet port1 'tcp port 80'. The 'diagnose sniffer packet' command is used to capture packets in FortiGate CLI.

Answer

diagnose debug flow

Answer

execute sniffer packet

Answer

diagnose sys session filter

Question 7

A FortiGate HA cluster is experiencing frequent failovers. The administrator checks the HA event log and sees repeated 'Heartbeat loss' messages. The heartbeat interfaces are connected directly via a crossover cable. What is the MOST likely cause?

Accepted Answer

The heartbeat interface has a duplex mismatch. When heartbeat interfaces are directly connected, duplex mismatch is a common physical-layer issue. If one end is set to auto-negotiation and the other to full-duplex, the link may become unstable, causing periodic heartbeat loss. This is more likely than a misconfigured interval or threshold, since the question notes repeated 'Heartbeat loss' messages, which point to physical layer problems.

Answer

The session pickup option is enabled

Answer

The HA uptime monitor is enabled and tracking a failed interface

Answer

The HA override setting is disabled

Question 8

An administrator runs 'diagnose debug flow' and sees the output 'no matching policy'. What does this indicate?

Accepted Answer

There is no firewall policy that allows the traffic from the source to the destination. The debug flow trace shows packets flowing through the firewall policy evaluation. 'No matching policy' means the packet did not match any firewall policy.

Answer

The packet is being processed by a policy with the correct source/destination

Answer

The packet was dropped due to an antivirus signature match

Answer

The packet is being routed through a blackhole route

Question 9

Which log severity level indicates that the system is unusable?

Accepted Answer

Emergency. FortiGate log severities follow standard syslog: Emergency (0) is the highest severity, indicating system is unusable.

Answer

Error

Answer

Critical

Answer

Alert

Question 10

An administrator needs to configure a FortiGate to send logs to an external FortiAnalyzer. Which setting is required?

Accepted Answer

Configuring FortiAnalyzer under Log Settings. FortiGate uses the 'Log Device' or 'FortiAnalyzer' configuration to send logs to an external FortiAnalyzer.

Answer

Setting the log disk quota

Answer

Configuring syslog server

Answer

Enabling FortiCloud logging

Question 11

An administrator wants to view the current session table entries filtered by destination port 443. Which command should be used?

Accepted Answer

diagnose sys session filter dport 443; diagnose sys session list. The 'diagnose sys session filter' command sets filters, and 'diagnose sys session list' displays the filtered sessions.

Answer

execute session list dport 443

Answer

diagnose debug flow filter dport 443

Answer

diagnose sys session list dport 443

Question 12

In an active-active HA cluster, session synchronization is configured. A new session is created on the primary unit. When does the secondary unit learn about this session?

Accepted Answer

Within a few milliseconds to seconds after creation. In active-active HA with session sync, sessions are synchronized periodically (every few seconds) or immediately depending on configuration. By default, sessions are synced every 200ms or when the session changes state.

Answer

During the next heartbeat interval

Answer

After the session is closed

Answer

Immediately upon session creation

Question 13

Which FortiGate feature allows users to access internal applications without a VPN client?

Accepted Answer

ZTNA. ZTNA (Zero Trust Network Access) enables agentless access to applications based on identity and context.

Answer

IPsec VPN

Answer

SSL VPN

Answer

FortiGuard

Question 14

An administrator notices that the FortiGate is not receiving updates from FortiGuard. The DNS settings are correct and the FortiGate can ping update.fortiguard.net. What is the MOST likely cause?

Accepted Answer

The FortiGuard subscription has expired. If DNS and connectivity are fine, the issue is often that the FortiGate's FortiGuard subscription has expired or the contract is not properly registered.

Answer

The firewall policy blocks outbound HTTPS

Answer

The antivirus profile is blocking the update traffic

Answer

The update server IP address changed

Question 15

An administrator configures HA override on a cluster with priority 200 on primary and 100 on secondary. The primary fails, secondary takes over. When primary recovers, what happens?

Accepted Answer

Primary immediately takes over as active. With HA override enabled, the higher priority unit (primary) will preempt the secondary upon recovery, assuming it has higher priority.

Answer

Both units become active, causing a conflict

Answer

Secondary remains active until next failover

Answer

The administrator must manually trigger failback