NSE4 High Availability and Diagnostics Practice Test 9 — 15 Questions

Question 1

A network admin receives an alert that the FortiGate disk logs are no longer being written. The admin checks the disk status and sees that the disk is full. However, the admin needs to preserve the logs for compliance purposes. Which action should the admin take to continue logging while preserving the existing logs?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure log upload to FortiAnalyzer and manually archive current logs, then clear the local disk. The correct action is to configure log upload to FortiAnalyzer and manually archive the current logs, then clear the local disk. This preserves the logs for compliance by offloading them to an external server, while freeing up disk space to allow new logging to continue. Other options are incorrect: increasing the disk quota does not solve the full issue, deleting logs loses compliance data, and compression alone may not free enough space immediately.

Answer

Increase the log disk quota to allow more logs

Answer

Delete all logs from the disk and restart logging

Answer

Compress the existing log files and set a higher compression level for future logs

Question 2

An administrator wants to monitor real-time traffic flows on a FortiGate, specifically to see packet details for traffic matching certain criteria. Which command should the administrator use to capture live packets on an interface?

Accepted Answer

diagnose sniffer packet. The 'diagnose sniffer packet' command is FortiGate's built-in packet capture tool, allowing administrators to capture live packets on a specified interface with optional filters for host, port, and protocol. It provides real-time packet-level visibility similar to tcpdump, which is exactly what is needed to inspect packet details for traffic matching specific criteria.

Answer

diagnose debug enable and diagnose debug flow trace

Answer

diagnose sys session list

Answer

execute system grep from CLI

Question 3

An administrator is troubleshooting a slow web application. The admin suspects that the FortiGate's session table might be full, causing new sessions to be dropped. Which command should the admin use to check the current session table utilization?

Accepted Answer

diagnose sys session stat. The command 'diagnose sys session stat' provides a summary of session table statistics, including the current session count, maximum session count, and utilization percentage. This directly answers whether the session table is full. It is the correct command to quickly assess session table utilization without listing every session.

Answer

get system performance status

Answer

diagnose sys session list

Answer

diagnose sys session filter

Question 4

A company has two FortiGate units in an active-active HA cluster. They want to ensure that sessions initiated from the internet through a virtual IP are synchronized to the peer unit in case of failover. Which HA setting is required?

Accepted Answer

Enable 'session-pickup' under config system ha. In a FortiGate active-active HA cluster, session-pickup (also called session synchronization) must be enabled under 'config system ha' to ensure that sessions — including those initiated through a virtual IP from the internet — are synchronized to the peer unit. Without session-pickup, a failover would drop existing sessions because the new primary has no state for them. This is the specific HA setting that controls whether firewall sessions are mirrored across cluster members.

Answer

Enable 'set ha-mgmt-status enable' on the WAN interface

Answer

Set 'set schedule' to 'round-robin' for the VIP

Answer

Configure the same virtual IP on both units

Question 5

An administrator needs to send logs from a FortiGate to a remote FortiAnalyzer for centralized log storage and analysis. Which configuration step is required on the FortiGate?

Accepted Answer

Set the FortiAnalyzer as the log destination in Log Settings. To send logs to FortiAnalyzer, the administrator must configure the FortiAnalyzer as a remote log destination under Log Settings. This is done via 'config log fortianalyzer setting' and specifying the server IP and other parameters.

Answer

Configure a firewall policy allowing traffic from FortiGate to FortiAnalyzer on port 514

Answer

Create a log forwarding rule to forward all logs to the FortiAnalyzer

Answer

Install a FortiGate connector on the FortiAnalyzer

Question 6

A FortiGate is configured with an active-passive HA cluster. The admin notices that when the primary unit fails, the secondary takes over, but after the primary recovers, it does not automatically become active again. What is the most likely reason?

Accepted Answer

Override is not enabled. In FortiGate HA, when the primary unit recovers after a failover, it does not automatically reclaim the primary role unless 'override' is enabled. Without override, the current primary (formerly secondary) retains the active role, and the recovered unit becomes the secondary. Enabling override allows the unit with the higher priority (or lower monitor priority value) to take over as primary when it comes back online.

Answer

The primary has a lower priority than the secondary

Answer

Session pickup is disabled

Answer

The heartbeat interface is down

Question 7

An administrator is configuring ZTNA (Zero Trust Network Access) on a FortiGate. The administrator needs to ensure that only clients with a valid posture assessment can access an internal application. Which access proxy setting must be configured to enforce this requirement?

Accepted Answer

Configure a ZTNA rule with a ZTNA tag requirement. ZTNA on FortiGate enforces zero trust by requiring clients to present a valid ZTNA tag, which is issued only after a successful posture assessment by FortiClient EMS. Configuring a ZTNA rule with a tag requirement ensures that only endpoints meeting the posture policy can reach the protected application through the access proxy. This is the mechanism that ties posture validation to access enforcement.

Answer

Enable SSL deep inspection on the access proxy

Answer

Set the access proxy to use certificate-based authentication

Answer

Enable multi-factor authentication on the access proxy

Question 8

An administrator is troubleshooting an issue where users cannot access an internal web server via the internet through a FortiGate. The FortiGate has a virtual IP (VIP) configured for the web server. The administrator runs 'diagnose debug flow filter daddr <public-ip>' and 'diagnose debug flow trace start 100'. The output shows 'msg: forward to x.x.x.x via intf port2' but then 'msg: policy deny'. Which TWO actions should the administrator take to resolve the issue? (Choose two.)

Accepted Answer

Confirm that the firewall policy's destination is set to the internal web server's IP address (or the VIP's mapped IP). Option C is correct because when a VIP is used, the firewall policy must reference the VIP object (or its mapped internal IP) as the destination; if the policy destination is left as 'all' or points to the wrong address, the flow trace will show 'policy deny' even though the packet is forwarded toward port2. Option D is correct because the policy permitting inbound access must match the actual ingress interface (the WAN interface where the public IP is reached); if the source interface is set to the internal/LAN interface or 'any' incorrectly, the policy lookup fails and produces 'policy deny'. Option A is not the issue here since the trace already shows the packet being forwarded out via intf port2, meaning routing toward the server exists and the deny occurs at policy evaluation, not at the routing stage. Option B is irrelevant because DNS resolution only affects name-to-IP mapping and would not cause a FortiGate policy deny for an already-arriving packet. Option E is unnecessary because the VIP is functioning (traffic is being forwarded), and changing the port would not fix a policy-match failure.

Answer

Ensure that a static route exists to the internet via the WAN interface

Answer

Check if the public DNS resolution for the domain is correct

Answer

Recreate the virtual IP object with a different port

Question 9

A FortiGate HA cluster is configured in active-passive mode with two units. The primary unit fails. The secondary unit takes over, but some established TCP sessions are dropped. What is the most likely cause?

Accepted Answer

Session synchronization is not enabled. In an active-passive FortiGate HA cluster, the primary unit synchronizes session state (including TCP session tables) to the secondary unit so that upon failover, established sessions can continue without interruption. If session synchronization is not enabled, the secondary unit has no knowledge of existing sessions, so when it takes over, it drops all established TCP sessions because it has no session entries for them. Thus, the most likely cause is that session synchronization is disabled.

Answer

The HA failover threshold is set too high

Answer

The HA mode is active-passive

Answer

The heartbeat interface is down

Question 10

An administrator wants to troubleshoot a traffic flow issue on a FortiGate. They suspect packets are being dropped. Which command should they use to perform a real-time packet capture on an interface?

Accepted Answer

diagnose sniffer packet. The command 'diagnose sniffer packet' is used on FortiGate to perform real-time packet capture on an interface. It allows administrators to see packet details, including headers and payloads, to troubleshoot traffic flow issues and identify dropped packets.

Answer

get system performance status

Answer

diagnose sys session list

Answer

diagnose debug flow

Question 11

A FortiGate administrator receives an alert that the FortiGuard antivirus database on the firewall is outdated. Which subscription service must be active to update the antivirus signatures?

Accepted Answer

FortiGuard Antivirus Service. The FortiGuard Antivirus Service subscription is the specific entitlement that provides signature updates for the antivirus engine on a FortiGate. Without an active FortiGuard AV subscription, the FortiGate cannot download updated virus definition databases, which is exactly the alert described. Each FortiGuard subscription is licensed and updated independently, so only the AV service covers AV signature refresh.

Answer

FortiGuard IPS Service

Answer

FortiGuard Application Control Service

Answer

FortiGuard Web Filtering Service

Question 12

An administrator is configuring a FortiGate HA cluster and wants to ensure that the primary unit is always preferred based on its configuration priority. Which setting should be enabled to allow the primary unit to resume its role after a failover if it regains connectivity?

Accepted Answer

set override enable. The 'set override enable' setting allows the primary unit to resume its role after a failover if it regains connectivity, based on its configured priority. Without override, the cluster does not preempt; the current primary remains primary even if a higher-priority unit rejoins. Enabling override ensures the primary unit always takes back its role when available.

Answer

set ha-inherit-priority enable

Answer

set session-pickup enable

Answer

set ha-priority 255

Question 13

A FortiGate administrator runs 'diagnose sys session filter dport 443' followed by 'diagnose sys session list' and sees the following output for a session:
src=10.0.1.10 dst=192.168.2.20 sport=12345 dport=443 proto=6
vrf=0

What does the 'proto=6' indicate about this session?

Accepted Answer

The session is using TCP. In IP protocol numbers, 6 represents TCP. The session output shows proto=6, which means the session is using TCP. This is consistent with dport=443, the standard HTTPS port over TCP. The FortiGate session table uses IANA protocol numbers to identify the transport protocol.

Answer

The session is using UDP

Answer

The session is using ESP

Answer

The session is using ICMP

Question 14

An administrator wants to view real-time debug output for traffic flowing through a FortiGate. Which command should they use to enable flow tracing with a specific source IP filter?

Accepted Answer

diagnose debug flow filter src. The command 'diagnose debug flow filter src <IP>' sets a filter to capture debug flow output for a specific source IP. This is the correct first step to enable flow tracing with a source IP filter. After setting the filter, the administrator would run 'diagnose debug enable' to start the debug output. The filter command itself is necessary to narrow down the traffic.

Answer

diagnose debug enable

Answer

diagnose sys session filter src

Answer

diagnose sniffer packet filter src

Question 15

An administrator wants to send logs from a FortiGate to an external syslog server. Which log forwarding method should they configure?

Accepted Answer

Syslog. FortiGate supports external log forwarding via syslog, which is the standard protocol for sending event and traffic logs to a remote server. Configuring syslog on the FortiGate involves specifying the server IP, port (default 514), and facility, and it allows the FortiGate to send logs in a structured format that can be parsed by SIEM or log management tools. SMTP is for email alerts, NetFlow is for traffic flow metadata, and SNMP is for monitoring and traps, not for general log transport.

Answer

SMTP

Answer

NetFlow

Answer

SNMP