How should I use these High Availability and Diagnostics practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just High Availability and Diagnostics questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the High Availability and Diagnostics domain.

NSE4 · topic practice

High Availability and Diagnostics practice questions

Practise Fortinet NSE 4 Network Security Professional NSE4 High Availability and Diagnostics practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: High Availability and Diagnostics

Practice 10 questions Browse domain →

What the exam tests

What to know about High Availability and Diagnostics

High Availability and Diagnostics questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common High Availability and Diagnostics exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

High Availability and Diagnostics questions

20 questions · select your answer, then reveal the explanation

Question 1mediummultiple choice

Read the full MPLS explanation →

A network engineer is configuring an SD-WAN rule to steer voice traffic to the MPLS link with the lowest latency. The SLA target is set to latency < 50 ms and jitter < 10 ms. However, the MPLS link occasionally exceeds the latency threshold. What should the engineer do to ensure voice traffic uses the best available link without manual intervention?

Trap 1: Remove the latency performance SLA and rely only on jitter.

Incorrect; removing latency SLA would not trigger failover based on latency.

Trap 2: Increase the jitter threshold to 15 ms to avoid SLA violations.

Incorrect; jitter threshold does not solve latency issues.

Trap 3: Disable SLA enforcement on the SD-WAN rule so voice traffic always…

Incorrect; disabling SLA would not prevent using the MPLS link when it has high latency.

Study all High Availability and Diagnostics common traps →

A
Remove the latency performance SLA and rely only on jitter.
Why wrong: Incorrect; removing latency SLA would not trigger failover based on latency.
B
Configure the SD-WAN rule with a secondary strategy to use the broadband link when SLA is not met.
Correct; this allows automatic failover to the broadband link when MPLS fails SLA.
C
Increase the jitter threshold to 15 ms to avoid SLA violations.
Why wrong: Incorrect; jitter threshold does not solve latency issues.
D
Disable SLA enforcement on the SD-WAN rule so voice traffic always uses the MPLS link.
Why wrong: Incorrect; disabling SLA would not prevent using the MPLS link when it has high latency.

Full breakdown with real-world context →

Question 2easymultiple choice

Read the full High Availability and Diagnostics explanation →

An administrator has two FortiGate units in an active-passive HA cluster. The cluster is configured to use the heartbeat interface port3. During a failover test, the primary unit fails but the secondary does not take over. What is the most likely cause?

Trap 1: The secondary unit has an override enabled.

Incorrect; override is used to force a unit to become primary, but does not prevent failover.

Trap 2: Session pickup is disabled on the cluster.

Incorrect; session pickup affects session synchronization, not failover triggering.

Trap 3: The HA uptime on the secondary is less than the primary.

Incorrect; HA uptime only affects priority if set to match, but not failover trigger.

Study all High Availability and Diagnostics common traps →

A
The secondary unit has an override enabled.
Why wrong: Incorrect; override is used to force a unit to become primary, but does not prevent failover.
B
The heartbeat interface (port3) is down on the secondary unit.
Correct; heartbeat loss prevents failover.
C
Session pickup is disabled on the cluster.
Why wrong: Incorrect; session pickup affects session synchronization, not failover triggering.
D
The HA uptime on the secondary is less than the primary.
Why wrong: Incorrect; HA uptime only affects priority if set to match, but not failover trigger.

Full breakdown with real-world context →

Question 3hardmultiple choice

Study the full SD-WAN breakdown →

A company has two remote sites connected via an SD-WAN overlay. The headquarters uses a FortiGate with two WAN links: Fiber (priority 1) and LTE (priority 2). The SD-WAN rule for business-critical traffic uses the 'best quality' strategy with SLA targets for latency and jitter. The fiber link occasionally experiences high jitter but low latency. The engineer notices that traffic is not failing over to LTE even when jitter exceeds the threshold. What is the most likely reason?

Trap 1: The SD-WAN rule has SLA match set to 'either' instead of 'all'.

Incorrect; 'either' would trigger failover if any SLA target fails.

Trap 2: The LTE link has a higher cost and is not considered for failover.

Incorrect; cost affects route selection, not failover trigger.

Trap 3: The fiber link has a higher interface weight.

Incorrect; weight does not affect SLA failover.

Study all High Availability and Diagnostics common traps →

A
The performance SLA for jitter is not configured, only latency.
Correct; only configured SLA targets are measured for failover.
B
The SD-WAN rule has SLA match set to 'either' instead of 'all'.
Why wrong: Incorrect; 'either' would trigger failover if any SLA target fails.
C
The LTE link has a higher cost and is not considered for failover.
Why wrong: Incorrect; cost affects route selection, not failover trigger.
D
The fiber link has a higher interface weight.
Why wrong: Incorrect; weight does not affect SLA failover.

Full breakdown with real-world context →

Question 4easymultiple choice

Read the full High Availability and Diagnostics explanation →

In an active-active HA cluster, which of the following must be identical on both FortiGate units?

Trap 1: HA priority

Incorrect; priority can differ to select primary.

Trap 2: Management IP address

Incorrect; management IPs are typically different.

Trap 3: Hostname

Incorrect; hostnames can be different.

Study all High Availability and Diagnostics common traps →

A
HA priority
Why wrong: Incorrect; priority can differ to select primary.
B
Management IP address
Why wrong: Incorrect; management IPs are typically different.
C
Virtual cluster ID
Correct; virtual cluster ID must match.
D
Hostname
Why wrong: Incorrect; hostnames can be different.

Full breakdown with real-world context →

Question 5mediummultiple choice

Read the full MPLS explanation →

An SD-WAN rule is configured with a 'manual' strategy and multiple members. The engineer wants to ensure that voice traffic always uses the MPLS link as long as it meets the SLA, otherwise use the broadband link. Which configuration is required?

Trap 1: Set the strategy to 'volume' and configure MPLS as preferred.

Incorrect; volume strategy is for load balancing, not failover.

Trap 2: Use 'load balancing' strategy and assign MPLS a higher weight.

Incorrect; weight does not guarantee exclusive use.

Trap 3: Set the strategy to 'best quality' and set MPLS with highest…

Incorrect; best quality uses dynamic metrics, not fixed priority.

Study all High Availability and Diagnostics common traps →

A
Set the strategy to 'volume' and configure MPLS as preferred.
Why wrong: Incorrect; volume strategy is for load balancing, not failover.
B
Set the manual strategy with MPLS as first member and enable SLA check.
Correct; manual strategy with SLA check will use the first member if SLA is met, otherwise the next.
C
Use 'load balancing' strategy and assign MPLS a higher weight.
Why wrong: Incorrect; weight does not guarantee exclusive use.
D
Set the strategy to 'best quality' and set MPLS with highest priority.
Why wrong: Incorrect; best quality uses dynamic metrics, not fixed priority.

Full breakdown with real-world context →

Question 6mediummulti select

Read the full High Availability and Diagnostics explanation →

Which TWO statements about FortiGate HA heartbeat interfaces are correct?

Trap 1: Heartbeat interfaces must be in the same VDOM.

Incorrect; heartbeat is not VDOM-specific.

Trap 2: Heartbeat interfaces must be dedicated management ports.

Incorrect; any physical interface can be used.

Trap 3: Only two heartbeat interfaces can be configured.

Incorrect; multiple heartbeat interfaces are supported.

Study all High Availability and Diagnostics common traps →

A
Heartbeat interfaces must be in the same VDOM.
Why wrong: Incorrect; heartbeat is not VDOM-specific.
B
Heartbeat interfaces must be dedicated management ports.
Why wrong: Incorrect; any physical interface can be used.
C
Heartbeat interfaces must be on the same subnet.
Correct; heartbeat requires L2 connectivity.
D
Heartbeat traffic is not encrypted by default.
Correct; encryption must be explicitly enabled.
E
Only two heartbeat interfaces can be configured.
Why wrong: Incorrect; multiple heartbeat interfaces are supported.

Full breakdown with real-world context →

Question 7hardmulti select

Study the full SD-WAN breakdown →

Which THREE statements about SD-WAN rules are correct?

Trap 1: SD-WAN rules must use a 'load balancing' strategy.

Incorrect; other strategies like manual or best quality are available.

Trap 2: Each SD-WAN rule can only contain one member.

Incorrect; rules can have multiple members.

Study all High Availability and Diagnostics common traps →

A
SD-WAN rules are evaluated in order of priority.
Correct; rules have priority and are evaluated top-down.
B
SD-WAN rules must use a 'load balancing' strategy.
Why wrong: Incorrect; other strategies like manual or best quality are available.
C
SD-WAN rules can match based on application, destination, or source.
Correct; SD-WAN rules have extensive match criteria.
D
Each SD-WAN rule can only contain one member.
Why wrong: Incorrect; rules can have multiple members.
E
If no SD-WAN rule matches, the traffic is processed by the implicit rule.
Correct; the implicit rule uses the configured load balancing algorithm.

Full breakdown with real-world context →

Question 8hardmultiple choice

Read the full High Availability and Diagnostics explanation →

Refer to the exhibit. An administrator has configured HA on two FortiGate units. During a failover test, the secondary unit does not take over when the primary fails. What is the most likely cause?

Exhibit

Refer to the exhibit.

config system ha
    set group-name "HA_Cluster"
    set mode a-p
    set hbdev "port3" 50
    set session-pickup enable
    set session-pickup-connectionless enable
    set ha-mgmt-status enable
    config ha-mgmt-interfaces
        edit 1
            set interface "port1"
            set gateway 10.0.1.1
        next
    end
    set override disable
    set priority 100
end

Trap 1: Session pickup is enabled but session-pickup-connectionless is also…

Incorrect; both can be enabled together.

Trap 2: Override is disabled, so the secondary cannot become primary.

Incorrect; override is not required for failover.

Trap 3: The priority on the secondary is set to a higher value than the…

Incorrect; priority determines primary, but failover still occurs.

Study all High Availability and Diagnostics common traps →

A
Session pickup is enabled but session-pickup-connectionless is also enabled, causing conflict.
Why wrong: Incorrect; both can be enabled together.
B
Override is disabled, so the secondary cannot become primary.
Why wrong: Incorrect; override is not required for failover.
C
The priority on the secondary is set to a higher value than the primary.
Why wrong: Incorrect; priority determines primary, but failover still occurs.
D
The heartbeat interface (port3) is down on the secondary unit.
Correct; heartbeat interface must be up for cluster communication.

Full breakdown with real-world context →

Question 9mediummultiple choice

Study the full SD-WAN breakdown →

Refer to the exhibit. An SD-WAN rule for voice traffic uses the SLA strategy with sla-match-mode 'any'. SLA 'sla1' measures ping to 8.8.8.8. If wan1 has latency 90 ms and jitter 10 ms, and wan2 has latency 110 ms and jitter 5 ms, which link will be selected for voice traffic?

Exhibit

Refer to the exhibit.

config system sdwan
    set status enable
    config members
        edit 1
            set interface "wan1"
            set gateway 10.0.0.254
            set source 10.0.0.1
        next
        edit 2
            set interface "wan2"
            set gateway 10.0.1.254
            set source 10.0.1.1
        next
    end
    config performance-sla
        edit 1
            set name "sla1"
            set server "8.8.8.8"
            set protocol "ping"
            set probe-packets 5
            set latency-threshold 100
            set jitter-threshold 20
        next
    end
    config service
        edit 1
            set name "voice"
            set mode sla
            set sla-match-mode any
            config sla
                edit "sla1"
                    set id 1
                next
            end
            set priority-members 1 2
        next
    end
end

Trap 1: Neither link, because both fail jitter?

Incorrect; both jitter values are below threshold.

Trap 2: Both links, because sla-match-mode 'any' allows any link that meets…

Incorrect; only wan1 meets SLA.

Trap 3: wan2, because it has lower jitter.

Incorrect; wan2 fails latency threshold.

Study all High Availability and Diagnostics common traps →

A
Neither link, because both fail jitter?
Why wrong: Incorrect; both jitter values are below threshold.
B
wan1, because it meets the SLA thresholds.
Correct; wan1 meets both latency and jitter thresholds.
C
Both links, because sla-match-mode 'any' allows any link that meets SLA.
Why wrong: Incorrect; only wan1 meets SLA.
D
wan2, because it has lower jitter.
Why wrong: Incorrect; wan2 fails latency threshold.

Full breakdown with real-world context →

Question 10hardmultiple choice

Open the full VLAN trunking answer →

A company has two FortiGate 100F units in an active-passive HA cluster with firmware version 7.2.5. The cluster is configured with session pickup and all interfaces are monitored. The network consists of three VLANs: VLAN10 (Users), VLAN20 (Servers), and VLAN30 (DMZ). The cluster is connected to two ISPs: ISP1 (port1) and ISP2 (port2). The internal network uses a single aggregated link (port3 and port4) as a LAG to the core switch. One day, the primary FortiGate experiences a hardware failure and the secondary takes over. After the primary is replaced and rejoins the cluster, the administrator notices that traffic passing through the cluster is intermittently dropping for a few seconds every minute. The administrator checks the cluster status and sees that the new primary (previously secondary) is in 'primary' state and the old primary (newly replaced) is in 'secondary' state. What is the most likely cause of the intermittent traffic drops?

Trap 1: Session pickup is not enabled on the new FortiGate.

Incorrect; session pickup is configured and working.

Trap 2: The HA cluster is in split-brain state.

Incorrect; the cluster status shows one primary and one secondary, not split-brain.

Trap 3: The heartbeat interface is configured on the LAG, causing HA…

Incorrect; heartbeat should not be on a LAG.

Study all High Availability and Diagnostics common traps →

A
The LAG configuration on the new FortiGate does not match the active cluster configuration.
Correct; mismatched LAG configuration can cause interface instability and traffic drops.
B
Session pickup is not enabled on the new FortiGate.
Why wrong: Incorrect; session pickup is configured and working.
C
The HA cluster is in split-brain state.
Why wrong: Incorrect; the cluster status shows one primary and one secondary, not split-brain.
D
The heartbeat interface is configured on the LAG, causing HA instability.
Why wrong: Incorrect; heartbeat should not be on a LAG.

Full breakdown with real-world context →

Question 11mediummultiple choice

Read the full MPLS explanation →

A network engineer is configuring SD-WAN on a FortiGate with two WAN links: MPLS (port1) and Internet (port2). The MPLS link has lower latency and jitter. The engineer wants to route all VoIP traffic (SIP and RTP) over the MPLS link unless it is unavailable. Which SD-WAN rule configuration should be used?

Trap 1: Create an SD-WAN rule for VoIP traffic with strategy 'best quality'…

This would only use MPLS if it meets SLA; if not, it might use Internet even if MPLS is up.

Trap 2: Create an SD-WAN rule for VoIP traffic with strategy 'load…

Load balancing would distribute traffic, not exclusively use MPLS.

Trap 3: Create an SD-WAN rule for VoIP traffic with strategy 'best quality'…

This would prefer the Internet link if it meets SLA, not MPLS.

Study all High Availability and Diagnostics common traps →

A
Create an SD-WAN rule for VoIP traffic with strategy 'best quality' and set the SLA target for latency to 10ms on the MPLS link.
Why wrong: This would only use MPLS if it meets SLA; if not, it might use Internet even if MPLS is up.
B
Create an SD-WAN rule for VoIP traffic with strategy 'load balancing' and assign equal weight to both links.
Why wrong: Load balancing would distribute traffic, not exclusively use MPLS.
C
Create an SD-WAN rule for VoIP traffic with strategy 'manual' or 'prefer' and select MPLS as the preferred member, with Internet as backup.
This ensures MPLS is used primarily and Internet only if MPLS is down.
D
Create an SD-WAN rule for VoIP traffic with strategy 'best quality' and set the SLA target to prefer the Internet link.
Why wrong: This would prefer the Internet link if it meets SLA, not MPLS.

Full breakdown with real-world context →

Question 12hardmulti select

Read the full High Availability and Diagnostics explanation →

A FortiGate is configured in an A-P HA cluster. The administrator wants to ensure that session failover occurs for UDP-based voice traffic. Which TWO settings must be enabled?

Trap 1: Set HA override to enabled.

HA override controls which unit becomes primary, not session synchronization.

Trap 2: Enable configuration synchronization.

Config sync ensures policies are identical, but does not synchronize session states.

Trap 3: Set failover hold time to 1 second.

Hold time affects how quickly failover occurs, not session synchronization.

Study all High Availability and Diagnostics common traps →

A
Enable UDP session synchronization.
UDP sessions need explicit synchronization for failover.
B
Set HA override to enabled.
Why wrong: HA override controls which unit becomes primary, not session synchronization.
C
Enable configuration synchronization.
Why wrong: Config sync ensures policies are identical, but does not synchronize session states.
D
Enable session pickup.
Session pickup allows the standby unit to continue sessions after failover.
E
Set failover hold time to 1 second.
Why wrong: Hold time affects how quickly failover occurs, not session synchronization.

Full breakdown with real-world context →

Question 13hardmultiple choice

Read the full High Availability and Diagnostics explanation →

Refer to the exhibit. The HA cluster has been operational for 5 days. The primary unit suddenly loses power. Which of the following will happen?

Exhibit

Refer to the exhibit.

config system ha
    set group-name "HA_Group"
    set mode a-p
    set hbdev "port1" 100
    set session-pickup enable
    set session-pickup-connectionless enable
    set priority 200
end

diagnose sys ha status

HA Health Status: OK
Model: FortiGate-100E
Group: HA_Group
Mode: A-P
Group ID: 0
Debug: 0

Cluster Uptime: 5 days 2 hours 15 mins

Cluster Members:

Member 1 (FGT100E3G17012345)
    Role: Primary
    Serial: FGT100E3G17012345
    Priority: 200
    Heartbeat interface: port1 (10.0.0.1)
    Heartbeat status: OK

Member 2 (FGT100E3G17012346)
    Role: Secondary
    Serial: FGT100E3G17012346
    Priority: 100
    Heartbeat interface: port1 (10.0.0.2)
    Heartbeat status: OK

Trap 1: The secondary unit will become primary, but all existing sessions…

Session pickup is enabled, so sessions should be maintained.

Trap 2: The cluster will remain without a primary until the original unit…

The secondary unit will automatically become primary.

Trap 3: The secondary unit will become primary and maintain only TCP…

Connectionless session pickup is enabled, so UDP sessions are also maintained.

Study all High Availability and Diagnostics common traps →

A
The secondary unit will become primary, but all existing sessions will be dropped.
Why wrong: Session pickup is enabled, so sessions should be maintained.
B
The cluster will remain without a primary until the original unit is restored.
Why wrong: The secondary unit will automatically become primary.
C
The secondary unit will become primary and maintain only TCP sessions.
Why wrong: Connectionless session pickup is enabled, so UDP sessions are also maintained.
D
The secondary unit will become primary and maintain existing UDP sessions.
Session pickup and session-pickup-connectionless are enabled, so UDP sessions are preserved.

Full breakdown with real-world context →

Question 14mediumdrag order

Read the full High Availability and Diagnostics explanation →

Drag and drop the steps to configure HA (High Availability) on a FortiGate pair into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 15mediummatching

Review the full routing breakdown →

Match each FortiGate routing concept to its definition.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Manually configured path to a destination network

Link-state routing protocol for internal networks

Path-vector routing protocol for internet and WAN

Routes traffic based on source/destination or service

Load-balances traffic across multiple routes with same cost

Question 16mediummultiple choice

Read the full High Availability and Diagnostics explanation →

An administrator has configured an active-passive HA cluster. During a failover test, the standby unit becomes active but existing user sessions are lost, requiring users to re-establish connections. Which configuration change would prevent this behavior?

Trap 1: Lower HA priority on the primary

Priority determines which unit becomes primary, not session state.

Trap 2: Set HA override to enabled

HA override controls preemption, not session synchronization.

Trap 3: Increase the heartbeat interval

Heartbeat interval affects failover detection time, not session persistence.

Study all High Availability and Diagnostics common traps →

A
Lower HA priority on the primary
Why wrong: Priority determines which unit becomes primary, not session state.
B
Enable session pickup
Session pickup is a FortiOS HA feature that synchronizes sessions to the standby unit for stateful failover.
C
Set HA override to enabled
Why wrong: HA override controls preemption, not session synchronization.
D
Increase the heartbeat interval
Why wrong: Heartbeat interval affects failover detection time, not session persistence.

Full breakdown with real-world context →

Question 17easymultiple choice

Read the full High Availability and Diagnostics explanation →

A network administrator runs the following CLI command on a FortiGate to capture traffic for troubleshooting: 'diagnose sniffer packet any "host 10.0.1.100" 4'. What does the '4' at the end of the command specify?

Trap 1: The filter verbosity level

Verbosity is the third parameter (e.g., 1=header, 2=header+hex, 3=header+hex+ASCII, 4=detailed).

Trap 2: The time duration in seconds

There is no time duration parameter; the count parameter limits packets.

Trap 3: The interface index

Interface is the first parameter, not the number.

Study all High Availability and Diagnostics common traps →

A
The filter verbosity level
Why wrong: Verbosity is the third parameter (e.g., 1=header, 2=header+hex, 3=header+hex+ASCII, 4=detailed).
B
The maximum number of packets to capture
The last parameter is count, which limits the number of packets captured.
C
The time duration in seconds
Why wrong: There is no time duration parameter; the count parameter limits packets.
D
The interface index
Why wrong: Interface is the first parameter, not the number.

Full breakdown with real-world context →

Question 18mediummultiple choice

Read the full High Availability and Diagnostics explanation →

In an active-active HA cluster, the administrator notices that traffic is not being load-balanced evenly across both units. What is the most likely cause?

Trap 1: The heartbeat interface speed is mismatched

Heartbeat speed does not affect traffic load balancing.

Trap 2: The load balance method is set to 'source-ip' which naturally…

Source-IP does distribute but may appear uneven; however the most likely cause is no load balancing method configured.

Trap 3: The cluster is using active-passive mode

The stem specifies active-active, so mode is correct.

Study all High Availability and Diagnostics common traps →

A
The load balance method is set to 'none'
If load-balance method is 'none', one unit handles all traffic; this is common misconfiguration.
B
The heartbeat interface speed is mismatched
Why wrong: Heartbeat speed does not affect traffic load balancing.
C
The load balance method is set to 'source-ip' which naturally causes imbalance
Why wrong: Source-IP does distribute but may appear uneven; however the most likely cause is no load balancing method configured.
D
The cluster is using active-passive mode
Why wrong: The stem specifies active-active, so mode is correct.

Full breakdown with real-world context →

Question 19hardmultiple choice

Read the full High Availability and Diagnostics explanation →

An administrator executes 'diagnose debug flow' for a specific session and sees the output: 'id=20085 trace_id=10 func=print_pkt_detail line=5567 msg="vd-root:0 received packet via port1".' Later, the trace shows 'msg="Deny by policy"'. What is the most likely next step the administrator should take?

Trap 1: Check the routing table for the destination

The packet was already received and denied by policy, not routing.

Trap 2: Restart the FortiGate to clear session table

Restarting is drastic and won't fix the policy configuration.

Trap 3: Enable session helper for the protocol

Session helpers are for ALG handling; denial by policy is not a session helper issue.

Study all High Availability and Diagnostics common traps →

A
Check the routing table for the destination
Why wrong: The packet was already received and denied by policy, not routing.
B
Review the firewall policies that apply to the traffic and modify as needed
The debug clearly states 'Deny by policy', so the solution is to adjust policy.
C
Restart the FortiGate to clear session table
Why wrong: Restarting is drastic and won't fix the policy configuration.
D
Enable session helper for the protocol
Why wrong: Session helpers are for ALG handling; denial by policy is not a session helper issue.

Full breakdown with real-world context →

Question 20mediummultiple choice

Read the full High Availability and Diagnostics explanation →

A FortiGate administrator needs to send logs to an external FortiAnalyzer for centralized monitoring. Which log configuration step is required?

Trap 1: Configure syslog server

Syslog is a different protocol; FortiAnalyzer uses proprietary logging protocol.

Trap 2: Enable FortiCloud logging

FortiCloud is a separate cloud service, not FortiAnalyzer.

Trap 3: Enable disk logging on the FortiGate

Disk logging is for local storage, not forwarding to FortiAnalyzer.

Study all High Availability and Diagnostics common traps →

A
Configure syslog server
Why wrong: Syslog is a different protocol; FortiAnalyzer uses proprietary logging protocol.
B
Add the FortiAnalyzer as a logging device in System > FortiAnalyzer
FortiAnalyzer is configured under System > FortiAnalyzer to enable log forwarding.
C
Enable FortiCloud logging
Why wrong: FortiCloud is a separate cloud service, not FortiAnalyzer.
D
Enable disk logging on the FortiGate
Why wrong: Disk logging is for local storage, not forwarding to FortiAnalyzer.

Full breakdown with real-world context →

Continue with 20-question session →

Free account

Track your progress over time

Create a free account to save your results and see which topics improve across sessions.

Focused High Availability and Diagnostics sessions

Start a High Availability and Diagnostics only practice session

Every question in these sessions is drawn from the High Availability and Diagnostics domain — nothing else.

10 questions 20 questions 30 questions 50 questions

Browse all High Availability and Diagnostics questions →Mixed NSE4 session

Frequently asked questions

What does the NSE4 exam test about High Availability and Diagnostics?: High Availability and Diagnostics questions test whether you can apply the concept in context, not just recognise a definition.
How should I use these practice questions?: Select your answer before revealing the explanation. Then read why each option is right or wrong — this active recall approach builds retention far faster than re-reading notes.
Can I practise just High Availability and Diagnostics questions in a focused session?: Yes — the session launcher on this page draws every question from the High Availability and Diagnostics domain. Use a 10-question session first to gauge your baseline, then move to 20 or 30 once the weak spots are clear.
Where can I practise other NSE4 topics?: Use the topic links above to move to related areas, or go back to the NSE4 question bank to see all topics.
Are these real exam questions or dumps?: These are original practice questions written to test the same concepts the NSE4 exam covers. They are not copied from any real exam or dump site.

High Availability and Diagnostics only

10 questions 20 questions 30 questions 50 questions

Mixed NSE4 session

Track your progress

A free account saves results across sessions and highlights which topics need work.

Study resources

All NSE4 questions High Availability and Diagnostics domain overview NSE4 exam guide

Exam traps to avoid

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

High Availability and Diagnostics practice questions

What to know about High Availability and Diagnostics

Common High Availability and Diagnostics exam traps

High Availability and Diagnostics questions

An administrator has two FortiGate units in an active-passive HA cluster. The cluster is configured to use the heartbeat interface port3. During a failover test, the primary unit fails but the secondary does not take over. What is the most likely cause?

In an active-active HA cluster, which of the following must be identical on both FortiGate units?

An SD-WAN rule is configured with a 'manual' strategy and multiple members. The engineer wants to ensure that voice traffic always uses the MPLS link as long as it meets the SLA, otherwise use the broadband link. Which configuration is required?

Which TWO statements about FortiGate HA heartbeat interfaces are correct?

Which THREE statements about SD-WAN rules are correct?

Refer to the exhibit. An administrator has configured HA on two FortiGate units. During a failover test, the secondary unit does not take over when the primary fails. What is the most likely cause?

Exhibit

Refer to the exhibit. An SD-WAN rule for voice traffic uses the SLA strategy with sla-match-mode 'any'. SLA 'sla1' measures ping to 8.8.8.8. If wan1 has latency 90 ms and jitter 10 ms, and wan2 has latency 110 ms and jitter 5 ms, which link will be selected for voice traffic?

Exhibit

A FortiGate is configured in an A-P HA cluster. The administrator wants to ensure that session failover occurs for UDP-based voice traffic. Which TWO settings must be enabled?

Refer to the exhibit. The HA cluster has been operational for 5 days. The primary unit suddenly loses power. Which of the following will happen?

Exhibit

Drag and drop the steps to configure HA (High Availability) on a FortiGate pair into the correct order.

Match each FortiGate routing concept to its definition.

An administrator has configured an active-passive HA cluster. During a failover test, the standby unit becomes active but existing user sessions are lost, requiring users to re-establish connections. Which configuration change would prevent this behavior?

A network administrator runs the following CLI command on a FortiGate to capture traffic for troubleshooting: 'diagnose sniffer packet any "host 10.0.1.100" 4'. What does the '4' at the end of the command specify?

In an active-active HA cluster, the administrator notices that traffic is not being load-balanced evenly across both units. What is the most likely cause?

A FortiGate administrator needs to send logs to an external FortiAnalyzer for centralized monitoring. Which log configuration step is required?

Track your progress over time

Start a High Availability and Diagnostics only practice session

Related NSE4 topic practice pages

System and Network Administration practice questions

Firewall Policies and NAT practice questions

Authentication and VPN practice questions

Security Profiles practice questions