NSE4 High Availability and Diagnostics Practice Question
Which log severity level indicates that the system is unusable?
⚠ Common exam trap
The trap is confusing Emergency with Alert or Critical; candidates might think Alert means the system is unusable, but Emergency is the only level that explicitly indicates that.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Emergency
The Emergency severity level (level 0) indicates that the system is unusable. It is the highest severity level in syslog (RFC 5424) and is used for catastrophic failures. Alert (level 1) indicates immediate action needed, Critical (level 2) indicates critical conditions, and Error (level 3) indicates error conditions, but Emergency specifically means the system is unusable.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Error
Why it's wrong here
In FortiGate logging, Error severity indicates that a specific operation or function has failed, such as an SSL handshake failure or an unreachable authentication server, but the system itself remains operational and continues to process traffic. The FortiGate unit is still able to perform its core security functions; therefore, this level does not mean the system is unusable. That condition is exclusively reserved for the highest severity: Emergency.
- ✗
Critical
Why it's wrong here
Critical severity is used when a serious condition requires immediate attention, such as a VPN tunnel dropping or an intrusion event, but the FortiGate typically remains capable of forwarding traffic and enforcing policies. While Critical is more severe than Error, it does not imply a complete loss of functionality. The device may be degraded or at risk, but it is still usable, so this option does not satisfy the question's wording.
- ✗
Alert
Why it's wrong here
Alert severity indicates that immediate action is needed to prevent a possible outage, such as a failing power supply or storage nearing capacity, yet the system continues to run and provide services at that moment. Alert is one step below Emergency in severity, so the condition is urgent but the device has not become inoperable. Only when the system is truly unusable does FortiGate generate an Emergency-level log, making Alert an incorrect answer.
- ✓
Emergency
Why this is correct
Emergency is the highest severity level (0) in FortiGate's logging hierarchy and specifically denotes that the system is unusable, as seen with a kernel panic, critical hardware failure, or complete resource exhaustion. When a FortiGate logs at Emergency severity, the device has either crashed or lost its ability to function, requiring manual intervention or a reboot. This exact definition matches the question's criterion, confirming Emergency as the correct answer.
Go deeper
Related to this question
About these practice questions
One of 773 original NSE4 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Fortinet exam blueprint
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.