NSE4 High Availability and Diagnostics Practice Question
Which log severity level indicates that a device is unusable and requires immediate attention?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Emergency
FortiGate log severity levels are: Emergency (0), Alert (1), Critical (2), Error (3), Warning (4), Notification (5), Information (6), Debug (7). Emergency is the highest severity, indicating the system is unusable.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Error
Why it's wrong here
Error (severity 3) marks error conditions that require attention, but the FortiGate continues processing traffic and management functions remain available. A non-fatal software fault or a failed interface negotiation can generate an Error log without taking the device offline. Because the device remains usable and can generally recover, Error does not indicate an unusable state.
- ✗
Critical
Why it's wrong here
Critical (severity 2) indicates serious conditions that may threaten ongoing operation, such as a power supply failure or a session table overflow. However, the system does not necessarily stop processing packets or become completely unavailable; it may still serve some functions or fail over to a redundant unit. A Critical log demands intervention, but it does not mean the device itself is unusable.
- ✓
Emergency
Why this is correct
Emergency (severity 0) is the highest syslog severity level and specifically denotes that the system is unusable. On FortiGate, this log is generated when a fatal condition halts operations, such as a kernel panic or a catastrophic disk failure that prevents booting. Unlike lower severities, Emergency means the device cannot perform its security functions or be administered until it is restarted or repaired.
- ✗
Alert
Why it's wrong here
Alert (severity 1) signals that immediate corrective action is required, for example when a security policy is disabled or a critical process has repeatedly failed. But an Alert does not inherently render the device unusable; the FortiGate may still pass traffic or accept management connections. Alert is more urgent than Error and Critical but still falls short of the total system loss represented by Emergency.
Go deeper
Related to this question
About these practice questions
One of 773 original NSE4 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on NSE4
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which log severity level indicates a failure that requires immediate attention?
easy- A.Debug
- ✓ B.Emergency
- C.Warning
- D.Information
Why B: In Fortinet's FortiOS, log severity levels follow the standard syslog protocol (RFC 5424). The 'Emergency' level (severity 0) indicates a system is unusable or has experienced a critical failure that requires immediate administrator intervention, such as a hardware failure or a security breach. This is the highest severity level, designed to alert for urgent action.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.