NSE4 High Availability and Diagnostics Practice Test 9 — 15 Questions

Question 1

A FortiGate administrator is setting up an HA cluster with two FortiGates. The heartbeat interfaces are connected via a dedicated switch. The administrator wants to ensure that the management IP is always accessible through the active unit. Which configuration is required?

Accepted Answer

Configure 'set management-ip' under the HA interface configuration. Option C is correct. In HA, the management interface IP must be configured on the HA interface or as a dedicated management interface. Setting 'set management-ip' on the HA interface ensures the management IP is always on the active unit.

Answer

Configure a virtual IP address for the management interface

Answer

Set the management IP on each unit separately

Answer

Use the same IP address on both units

Question 2

An administrator wants to view the current session table on a FortiGate. Which command should they use?

Accepted Answer

diagnose sys session list. Option C is correct. 'diagnose sys session list' displays the current session table, showing all active sessions.

Answer

diagnose debug flow

Answer

show full-configuration

Answer

get system performance statistics

Question 3

A FortiGate administrator notices that the HA cluster is frequently failing over even though no hardware failure has occurred. The heartbeat link shows some packet loss. What is the best action to reduce unnecessary failovers?

Accepted Answer

Increase the failover threshold. Option D is correct. Increasing the failover threshold (the number of missed heartbeats before triggering failover) makes the cluster more tolerant to temporary heartbeat loss, reducing false failovers.

Answer

Lower the heartbeat interval

Answer

Change HA mode to active-active

Answer

Disable session synchronization

Question 4

Which of the following FortiGate log types records information about user authentication and administrative access?

Accepted Answer

Event logs. Option A is correct. Event logs record system events such as user authentication, admin logins, and configuration changes.

Answer

Traffic logs

Answer

System logs

Answer

Security logs

Question 5

An administrator needs to store logs for compliance purposes and wants them to be retained even if the FortiGate is reset. Which log storage option should they use?

Accepted Answer

FortiAnalyzer. Option C is correct. FortiAnalyzer provides centralized log storage that is separate from the FortiGate, ensuring logs are retained even if the FortiGate is reset.

Answer

FortiCloud logs

Answer

Syslog server

Answer

Local disk logs

Question 6

In an active-passive HA cluster, the administrator wants to ensure that new connections are load-balanced across both units only for specific services while maintaining failover capability. Which configuration should be applied?

Accepted Answer

Enable 'set load-balance-schedule' on the HA interface. Option B is correct. Load balancing in HA is achieved by enabling 'load-balance-schedule' on the HA interface. This allows distributing new sessions across cluster units while retaining active-passive failover behavior.

Answer

Set 'set ha-priority' to 100 on both units

Answer

Change HA mode to active-active

Answer

Configure virtual IPs for each service

Question 7

A FortiGate administrator is diagnosing a performance issue. They notice that the CPU usage is consistently high. Which command can provide a real-time view of the processes consuming CPU?

Accepted Answer

diagnose sys top. Option D is correct. 'diagnose sys top' provides a real-time top-like view of processes and their CPU/memory usage, helpful for identifying resource hogs.

Answer

get system performance status

Answer

diagnose sys session stat

Answer

diagnose debug flow

Question 8

An administrator wants to ensure that log messages are categorized by severity and that only events with severity 'error' and above are sent to the syslog server. Which configuration should be used?

Accepted Answer

Set 'set severity error' in syslog config. Option B is correct. In syslog settings, 'set severity' defines the minimum severity level to send. Setting it to 'error' includes error, critical, alert, and emergency messages.

Answer

Set 'set severity critical' in syslog config

Answer

Set 'set severity warning' in syslog config

Answer

Set 'set severity alert' in syslog config

Question 9

In a FortiGate HA cluster, the administrator needs to perform a firmware upgrade without causing a full service outage. Which procedure should be followed?

Accepted Answer

Upgrade the secondary unit first, then perform a failover, then upgrade the primary unit. Option A is correct. The recommended procedure to upgrade with minimal downtime is to upgrade the secondary unit first, then force a failover to make it primary, and then upgrade the former primary unit.

Answer

Upgrade the primary unit first, then the secondary unit

Answer

Disable HA and upgrade each unit separately

Answer

Upgrade both units simultaneously

Question 10

Which FortiGate feature allows administrators to verify if a specific IP address is being blocked by a security policy?

Accepted Answer

diagnose debug flow. Option B is correct. 'diagnose debug flow' can trace a packet from a specific source IP and show whether it is allowed or denied by a firewall policy.

Answer

diagnose sys session list

Answer

get system ha status

Answer

diagnose sniffer packet

Question 11

A FortiGate administrator configures a ZTNA rule to protect an internal web server. The rule uses an access proxy. Which component on the FortiGate terminates the incoming ZTNA connection?

Accepted Answer

ZTNA gateway. Option A is correct. The ZTNA gateway is the FortiGate component that terminates the incoming TLS connection from the client and proxies the request to the internal server.

Answer

ZTNA tag

Answer

SSL inspection profile

Answer

ZTNA application

Question 12

An administrator is troubleshooting a FortiGate that is not sending logs to FortiAnalyzer. The FortiAnalyzer is reachable from the FortiGate. Which command should the administrator use to test the connectivity and log forwarding?

Accepted Answer

execute log fortianalyzer test. Option D is correct. 'execute log fortianalyzer test' sends a test log to FortiAnalyzer to verify connectivity and configuration.

Answer

execute log send

Answer

ping <FortiAnalyzer IP>

Answer

diagnose debug application fortianalyzer

Question 13

An administrator configures a FortiGate HA cluster in active-passive mode. After a failover, some UDP-based sessions are lost. What is the MOST likely reason?

Accepted Answer

UDP session synchronization is not enabled by default. UDP is stateless and not synchronized by default in active-passive HA unless session synchronization is configured. TCP sessions are synchronized by default.

Answer

The heartbeat interface failed

Answer

The failover triggered a routing table change

Answer

The HA priority was set too low on the backup unit

Question 14

An administrator wants to capture HTTP traffic on port1 for troubleshooting. Which CLI command should be used?

Accepted Answer

diagnose sniffer packet port1 'tcp port 80'. The 'diagnose sniffer packet' command is used to capture packets in FortiGate CLI.

Answer

diagnose debug flow

Answer

execute sniffer packet

Answer

diagnose sys session filter

Question 15

A FortiGate HA cluster is experiencing frequent failovers. The administrator checks the HA event log and sees repeated 'Heartbeat loss' messages. The heartbeat interfaces are connected directly via a crossover cable. What is the MOST likely cause?

Accepted Answer

The heartbeat interface has a duplex mismatch. If heartbeat interfaces are directly connected, the expected behavior is stable. Frequent heartbeat loss suggests the heartbeat interval or failover threshold is misconfigured, or there is duplex mismatch.

Answer

The session pickup option is enabled

Answer

The HA uptime monitor is enabled and tracking a failed interface

Answer

The HA override setting is disabled