NSE4 High Availability and Diagnostics Practice Question
Which FortiGate log severity level indicates that a system is unusable and requires immediate attention?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Emergency
Emergency is the highest severity level in syslog/FortiGate, indicating a system is unusable. Critical indicates critical conditions but not necessarily unusable.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Error
Why it's wrong here
Error (severity 3) is a log level that records a malfunction, misconfiguration, or failed operation, but the FortiGate remains operational and continues to process traffic. It indicates a localized issue, such as a failed WAN interface or a certificate validation failure, which does not render the entire system unusable, so it cannot be the correct answer for 'system is unusable.'
- ✗
Critical
Why it's wrong here
Critical (severity 2) denotes a serious condition that requires immediate attention, such as a firewall cluster sync failure or a power supply warning, yet the system may still handle normal traffic or recover automatically. Because critical events do not necessarily imply that the FortiGate has lost all functionality, they are a step below the state of being completely unusable, making this option incorrect.
- ✓
Emergency
Why this is correct
Emergency (severity 0) is the highest log severity level and is reserved for situations where the FortiGate system is completely unusable, such as a kernel panic, total configuration failure, or unrecoverable hardware fault. This level indicates that the firewall cannot perform any of its security functions, and immediate intervention is required, which is exactly what the question asks to identify.
- ✗
Alert
Why it's wrong here
Alert (severity 1) indicates an event that requires immediate corrective action, like a detected intrusion attempt or a critical monitoring threshold being exceeded, but the system continues to operate and enforce security policies. Unlike Emergency, Alert does not describe a total loss of function; the system remains usable even though its state may be precarious, so this option is not correct.
Go deeper
Related to this question
About these practice questions
One of 773 original NSE4 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on NSE4
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which log severity level indicates that the system is unusable?
easy- A.Error
- B.Critical
- C.Alert
- ✓ D.Emergency
Why D: The Emergency severity level (level 0) indicates that the system is unusable. It is the highest severity level in syslog (RFC 5424) and is used for catastrophic failures. Alert (level 1) indicates immediate action needed, Critical (level 2) indicates critical conditions, and Error (level 3) indicates error conditions, but Emergency specifically means the system is unusable.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.