CCNA High Availability and Diagnostics Questions

Multi-Selecthard

A FortiGate administrator is configuring an active-passive HA cluster and needs to ensure that management access is available via a dedicated management IP address that does not fail over. Which three steps should the administrator take? (Choose three.)

Select 3 answers

A.Assign an IP address to the management interface

B.Enable 'set ha-mgmt-interface' on the management interface

C.Set the management interface to be part of the HA cluster management IP

D.Ensure the management interface is not configured as a heartbeat interface

E.Configure a dedicated management interface (e.g., port3)

AnswersA, D, E

The IP must be configured on the interface for management access.

Why this answer

To have a dedicated management IP that does not fail over, the administrator should configure a dedicated management interface (separate from HA heartbeat), assign an IP to it, and ensure the management access is configured on that interface. The management interface can be in a separate VDOM if desired.

Practice this question →

Multi-Selectmedium

A FortiGate administrator is configuring logging to meet a compliance requirement that all security events must be stored for at least one year. The FortiGate has limited local disk space. Which THREE actions should the administrator take to meet this requirement? (Choose three.)

Select 3 answers

A.Set the log severity filter to only log 'emergency' events to reduce volume

B.Configure log rolling and retention policies to automatically delete older logs from the local disk after a set period

C.Disable local disk logging to save space

D.Configure the FortiGate to send logs to a FortiAnalyzer device

E.Enable logging to FortiCloud for cloud-based log storage

AnswersB, D, E

This manages local disk space by rotating logs, while external storage retains them long-term.

Why this answer

The administrator needs to store logs for at least one year with limited local disk space. To comply, logs must be offloaded to external storage or the cloud. Configuring log rolling and retention on the local disk (B) allows automatic deletion of old logs to free space, ensuring only recent logs are kept locally while older logs are deleted if not offloaded.

However, to meet the one-year retention, offloading is necessary: sending logs to FortiAnalyzer (D) provides centralized long-term storage, and enabling FortiCloud logging (E) offers cloud-based retention. Disabling local disk logging (C) would stop log storage entirely, losing logs unless offloading is configured, but it is not a standalone solution. Setting severity to emergency only (A) would miss most security events, violating the requirement to log all security events.

Therefore, the correct three actions are B, D, and E.

Practice this question →

MCQmedium

An SD-WAN rule is configured with a 'manual' strategy and multiple members. The engineer wants to ensure that voice traffic always uses the MPLS link as long as it meets the SLA, otherwise use the broadband link. Which configuration is required?

A.Set the strategy to 'volume' and configure MPLS as preferred.

B.Set the manual strategy with MPLS as first member and enable SLA check.

C.Use 'load balancing' strategy and assign MPLS a higher weight.

D.Set the strategy to 'best quality' and set MPLS with highest priority.

AnswerB

Correct; manual strategy with SLA check will use the first member if SLA is met, otherwise the next.

Why this answer

A manual strategy with ordered members and an SLA check allows the SD-WAN rule to first attempt the MPLS link; if the SLA is met, traffic uses MPLS, and if the SLA fails, the rule automatically fails over to the next member (broadband). This directly implements the engineer's requirement of 'MPLS if SLA met, otherwise broadband.'

Exam trap

The trap here is that candidates often confuse 'manual strategy' with 'best quality' strategy, assuming 'best quality' will always pick MPLS, but 'best quality' dynamically selects the best-performing link at any moment, which may not be MPLS if broadband has better SLA metrics.

How to eliminate wrong answers

Option A is wrong because the 'volume' strategy distributes traffic based on volume ratios, not on SLA compliance or preferred link selection. Option C is wrong because 'load balancing' strategy distributes traffic across members based on weights, not on SLA-based failover; a higher weight does not guarantee exclusive use of MPLS when SLA is met. Option D is wrong because 'best quality' strategy selects the link with the best SLA performance dynamically, but it does not enforce a strict preference for MPLS first; it may choose broadband if it has better metrics at that moment.

Practice this question →

MCQhard

An administrator runs 'diagnose debug flow' for a specific policy and sees the following output: id=20085 trace_id=10 func=vf_ip_route_in msg='No matching interface to route packet' What does this indicate?

A.The packet is being blocked by a firewall policy

B.The source interface is down

C.The destination IP address has no matching route in the routing table

D.The session table is full

AnswerC

The message clearly states no matching interface to route the packet.

Why this answer

The trace indicates that FortiGate cannot find a route to forward the packet, meaning the destination is unreachable.

Practice this question →

Multi-Selectmedium

An active-passive HA cluster is experiencing frequent failovers. Which TWO factors could cause unnecessary failovers? (Choose two.)

Select 2 answers

A.Using a data interface as the heartbeat interface

B.An unstable network link for the heartbeat

C.Different firmware versions on cluster members

D.Mismatched HA passwords between cluster members

E.Mismatched HA priority values

AnswersA, B

Data interfaces may have fluctuating link status, triggering failover.

Why this answer

Incorrect heartbeat interface configuration (e.g., using a busy data port) can cause false positives. A mismatched HA password prevents proper communication, but may not cause failover; mismatched priority affects role selection, not failover frequency. Unstable heartbeat links cause failover.

Practice this question →

MCQhard

An administrator runs 'diagnose sys session filter dport 443' and then 'diagnose sys session list'. The output shows many sessions with 'proto_state=01' and 'expire=3599'. What does 'expire=3599' indicate?

A.The session has 3599 packets

B.The session has been alive for 3599 seconds

C.The session has 3599 bytes of data transferred

D.The session will timeout in 3599 seconds

AnswerD

Expire shows remaining time before the session is removed due to inactivity.

Why this answer

In FortiGate diagnostics, the 'expire' field in the session list output indicates the remaining time in seconds before the session times out. A value of 3599 seconds means the session will be removed from the session table after that many seconds of inactivity, assuming no further traffic matches the session. This is a key metric for understanding session lifecycle and timeout behavior.

Exam trap

The trap here is confusing 'expire' (remaining time until timeout) with 'duration' (time since session creation), leading candidates to incorrectly select option B.

How to eliminate wrong answers

Option A is wrong because 'expire' does not represent a packet count; packet counts are shown in separate fields like 'packets' or 'pkt_in/pkt_out'. Option B is wrong because 'expire' is the remaining time until timeout, not the elapsed time since the session was created; the 'duration' field tracks how long the session has been alive. Option C is wrong because 'expire' is unrelated to data transfer size; byte counts are displayed in fields such as 'bytes' or 'total_bytes'.

Practice this question →

MCQmedium

A network admin receives an alert that the FortiGate disk logs are no longer being written. The admin checks the disk status and sees that the disk is full. However, the admin needs to preserve the logs for compliance purposes. Which action should the admin take to continue logging while preserving the existing logs?

A.Configure log upload to FortiAnalyzer and manually archive current logs, then clear the local disk

B.Increase the log disk quota to allow more logs

C.Delete all logs from the disk and restart logging

D.Compress the existing log files and set a higher compression level for future logs

AnswerA

Uploading existing logs to FortiAnalyzer preserves them off-device, then clearing the local disk frees space for continued logging. This is the proper workflow.

Why this answer

The correct action is to configure log upload to FortiAnalyzer and manually archive the current logs, then clear the local disk. This preserves the logs for compliance by offloading them to an external server, while freeing up disk space to allow new logging to continue. Other options are incorrect: increasing the disk quota does not solve the full issue, deleting logs loses compliance data, and compression alone may not free enough space immediately.

Practice this question →

MCQhard

A company has two remote sites connected via an SD-WAN overlay. The headquarters uses a FortiGate with two WAN links: Fiber (priority 1) and LTE (priority 2). The SD-WAN rule for business-critical traffic uses the 'best quality' strategy with SLA targets for latency and jitter. The fiber link occasionally experiences high jitter but low latency. The engineer notices that traffic is not failing over to LTE even when jitter exceeds the threshold. What is the most likely reason?

A.The performance SLA for jitter is not configured, only latency.

B.The SD-WAN rule has SLA match set to 'either' instead of 'all'.

C.The LTE link has a higher cost and is not considered for failover.

D.The fiber link has a higher interface weight.

AnswerA

Correct; only configured SLA targets are measured for failover.

Why this answer

The SD-WAN rule uses the 'best quality' strategy, which selects the best link based on configured SLA metrics. If only latency is configured in the performance SLA, jitter exceeding the threshold will not trigger a failover, as the SLA only evaluates the configured metrics. The fiber link may still meet the latency SLA, so traffic remains on it despite high jitter.

Exam trap

The trap here is that candidates assume jitter is automatically monitored in SD-WAN SLA, but FortiGate requires explicit configuration of each metric (latency, jitter, packet loss) in the performance SLA; otherwise, unconfigured metrics are ignored for failover decisions.

How to eliminate wrong answers

Option B is wrong because the 'either' vs 'all' setting in SLA match determines whether any or all configured SLA targets must be met for the link to be considered compliant; it does not prevent failover when jitter exceeds the threshold if jitter is not configured. Option C is wrong because SD-WAN failover decisions are based on SLA compliance and strategy, not link cost; cost influences route selection in routing protocols but not SD-WAN rule failover. Option D is wrong because interface weight affects load-balancing ratios in strategies like 'lowest cost' or 'maximize bandwidth', not failover decisions in 'best quality' strategy.

Practice this question →