NSE4 High Availability and Diagnostics Practice Question
Which log severity level indicates a failure that requires immediate attention?
⚠ Common exam trap
Many candidates confuse 'Warning' with a critical failure, but 'Warning' only indicates a potential problem, while 'Emergency' is the only level that signifies a system-wide failure requiring immediate attention.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Emergency
In Fortinet's FortiOS, log severity levels follow the standard syslog protocol (RFC 5424). The 'Emergency' level (severity 0) indicates a system is unusable or has experienced a critical failure that requires immediate administrator intervention, such as a hardware failure or a security breach. This is the highest severity level, designed to alert for urgent action.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Debug
Why it's wrong here
Debug is the most verbose and least severe log level, used for capturing low-level troubleshooting details such as packet headers, internal state transitions, or variable values. It is not intended to represent any failure condition; rather, it helps engineers diagnose complex issues by providing granular insight into normal or suspected behavior. Because it merely describes operational minutiae, Debug cannot indicate a failure that requires immediate action, and in production environments it is typically disabled to avoid log flooding.
- ✓
Emergency
Why this is correct
Emergency is the highest severity level in FortiGate logging, reserved for conditions that render the system unusable or that require immediate administrator intervention, such as a detected power loss, fatal system error, or hardware malfunction. Unlike other levels, Emergency signals an active, often catastrophic failure that demands urgent action to restore service and prevent data loss or security compromise. This directly matches the question's requirement for a failure that necessitates immediate response, making Emergency the correct choice.
- ✗
Warning
Why it's wrong here
Warning indicates a potential problem or abnormal condition that could escalate but does not currently cause a service outage or direct failure. Examples include high CPU or memory usage, a fortiheartbeat failure, or a configuration that deviates from a recommended baseline. Warnings are intended for proactive monitoring and troubleshooting, not for immediate emergency action; thus, while important, they do not meet the threshold of a failure requiring instantaneous response.
- ✗
Information
Why it's wrong here
Information logs routine, non-error operational events such as user logins, configuration changes, or VPN tunnel establishment, providing an audit trail for normal system activities. This severity level is purely informational and carries no sense of failure or urgency; it is used to track what happened without implying any problem. Since the question specifically asks about a failure that requires immediate action, Information is clearly not the correct severity level.
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE4 question from scratch — 773 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.