Scenario practice questions

NAT traversal is enabled on all gateways

Why wrong: NAT traversal is automatically enabled in IKEv2 when needed.

IKEv1 is used for the spoke-to-hub tunnels

Why wrong: ADVPN requires IKEv2.

Disable route leaking between VRFs

Why wrong: Disabling route leaking would break connectivity, not fix asymmetry.

Increase the administrative distance of the leaked routes

Why wrong: Changing administrative distance may affect route selection but does not enforce symmetry.

Schedule (e.g., run every hour)

Why wrong: Automation stitches are event-driven, not scheduled.

Condition (e.g., severity threshold)

Why wrong: Condition is part of the trigger, not a separate component.

Standalone mode

Why wrong: No redundancy.

Active-active HA

Why wrong: Active-active HA is incorrect because it complicates firmware upgrades with minimal downtime; both units actively process traffic, making a phased upgrade without service interruption more challenging than with active-passive. This mode is tempting as it offers load balancing and maximises hardware utilisation by distributing traffic across all cluster members. It would be the correct choice when the primary goal is to achieve higher aggregate throughput and active traffic distribution, rather than simplified maintenance procedures or a single-unit upgrade strategy.

FGCP mode

Why wrong: FGCP is the protocol used for HA, not a mode.

RIP

Why wrong: RIP is a distance-vector routing protocol based on hops.

OSPF route redistribution

Why wrong: Redistribution injects routes into OSPF, not criteria-based forwarding.

ECMP

Why wrong: ECMP balances across equal-cost routes based on destination.

The FortiGate's clock is not synchronized with FortiAnalyzer

Why wrong: Clock skew would affect correlations but not prevent FortiView from showing data.

The FortiAnalyzer ADOM is configured as a global ADOM

Why wrong: Global ADOM affects object sharing, not FortiView display.

The FortiAnalyzer disk is full and not indexing new logs

Why wrong: If logs are received, disk full would prevent storage, but logs are being received.

The priority values are set identically

Why wrong: Identical priority can cause election issues but not split-brain if heartbeat is working.

The HA uptime is mismatched between the two units

Why wrong: Uptime mismatch does not cause split-brain; it's a symptom of failed synchronization.

The session pickup feature is disabled

Why wrong: Session pickup affects failover behavior, not split-brain.

To load balance traffic across multiple paths.

Why wrong: BFD does not load balance.

To authenticate OSPF neighbors.

Why wrong: OSPF has its own authentication; BFD is separate.

To encrypt traffic between two FortiGates.

Why wrong: BFD is not encryption; it's a detection protocol.

The ZTNA application is not configured with HTTPS

Why wrong: ZTNA supports both HTTP and HTTPS; this is not a likely cause.

The FortiClient EMS server is not reachable from the FortiGate

Why wrong: If EMS is unreachable, FortiClient may not get tags, but the connection would likely fail earlier.

The FortiGate is not configured with the correct ZTNA application gateway

Why wrong: This would prevent connection altogether, not just block access after authentication.

OSPF is configured with 'network point-to-multipoint'

Why wrong: Incorrect. The network type point-to-multipoint does not prevent BFD from working; BFD supports various OSPF network types.

The neighbor does not have BFD enabled on its OSPF configuration

Why wrong: Incorrect. Although BFD requires both ends to enable it, the question asks for a possible reason on the local FortiGate. The neighbor may have BFD enabled, but the local interface missing the setting is the more direct cause.

The FortiGate's BFD transmit interval is set too high

Why wrong: Incorrect. Setting the BFD transmit interval too high may affect detection speed but should not prevent BFD sessions from coming up entirely.

Check that NAT is enabled on the policies

Why wrong: NAT is not required for inter-VDOM routing; it can be used but is not necessary.

Check that the inter-VDOM link is configured as a physical interface

Why wrong: The inter-VDOM link is a logical link, not a physical interface.

Check that both VDOMs are in the same administrative VDOM

Why wrong: Administrative VDOM is separate; traffic VDOMs are different.

One unit has a higher priority

Why wrong: Higher priority determines primary, does not cause split-brain.

Firmware version mismatch

Why wrong: Firmware mismatch is not supported but may cause issues, not necessarily split-brain.

Session pickup is disabled

Why wrong: Session pickup does not affect split-brain.

diagnose debug application had 0

Why wrong: This enables debug output, not a simple status check.

diagnose sys ha dump

Why wrong: This command dumps HA memory but is not the primary command to check status.

show system ha

Why wrong: 'show' is for configuration, not status.

To load balance traffic across multiple links.

Why wrong: BFD is for failure detection, not load balancing.

To encrypt BGP updates between peers.

Why wrong: BFD does not provide encryption; it is a detection protocol.

To authenticate OSPF neighbors.

Why wrong: Authentication is separate; BFD can be used with OSPF but its purpose is fast failure detection.

Mismatched pre-shared keys.

Why wrong: Pre-shared key mismatch would cause Phase 1 to fail, not Phase 2.

Dead Peer Detection (DPD) settings are too aggressive.

Why wrong: DPD issues would cause the tunnel to drop after being established, not a Phase 2 failure.

Certificate validation failure.

Why wrong: Certificate issues would affect Phase 1 if certificate authentication is used, but logs show Phase 1 is up.

A static route to the malicious IP

Why wrong: Unnecessary.

An SSL certificate for the FortiGate

Why wrong: Not relevant.

A firewall policy that allows the traffic

Why wrong: Not directly required for the automation stitch itself.

The heartbeat interface has been administratively disabled

Why wrong: An admin disable would show 'administratively down', not 'link down'.

The HA group ID is different on each unit

Why wrong: Different group IDs would prevent HA formation, but link would still show up.

The HA priority values are the same on both units

Why wrong: Equal priority could cause election issues but not split-brain if heartbeat is working.

To encrypt routing protocol traffic

Why wrong: BFD does not encrypt; it is a detection mechanism.

To authenticate routing peers

Why wrong: Authentication is done via MD5 or SHA, not BFD.

To provide load balancing across multiple paths

Why wrong: Load balancing is done by ECMP or SD-WAN.

The HA priority is set to the same value on both units

Why wrong: Same priority can cause election issues but not typically split-brain; one will still become primary.

The HA mode is set to 'active-active' instead of 'active-passive'

Why wrong: Active-active mode does not cause split-brain; both units are active but with session load balancing.

The HA cluster is using a unicast heartbeat and the configuration is incorrect

Why wrong: Incorrect unicast configuration can prevent heartbeat, leading to split-brain, but the primary cause is loss of heartbeat.