The answer is a LAG configuration mismatch on the newly replaced FortiGate. In an active-passive HA cluster, all LAG member interfaces—such as port3 and port4—must have identical LACP mode, speed, duplex, and VLAN membership across both units. When the secondary unit took over as primary and the replaced unit rejoined as secondary, any discrepancy in these settings forces the cluster to continuously renegotiate the aggregated link, causing brief traffic drops every few seconds as the HA tries to synchronize interface states. This scenario tests your understanding of HA interface synchronization requirements for the Fortinet NSE 4 Network Security Professional exam, where a common trap is assuming that hardware replacement alone restores full functionality without verifying LAG consistency. Remember the memory tip: LAG stands for “Link Aggregation Group,” but in HA, it also means “Look Alike Group”—every setting must match exactly on both firewalls.
NSE4 High Availability and Diagnostics Practice Question
This NSE4 practice question tests your understanding of high availability and diagnostics. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A company has two FortiGate 100F units in an active-passive HA cluster with firmware version 7.2.5. The cluster is configured with session pickup and all interfaces are monitored. The network consists of three VLANs: VLAN10 (Users), VLAN20 (Servers), and VLAN30 (DMZ). The cluster is connected to two ISPs: ISP1 (port1) and ISP2 (port2). The internal network uses a single aggregated link (port3 and port4) as a LAG to the core switch. One day, the primary FortiGate experiences a hardware failure and the secondary takes over. After the primary is replaced and rejoins the cluster, the administrator notices that traffic passing through the cluster is intermittently dropping for a few seconds every minute. The administrator checks the cluster status and sees that the new primary (previously secondary) is in 'primary' state and the old primary (newly replaced) is in 'secondary' state. What is the most likely cause of the intermittent traffic drops?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue: "most likely"
Why it matters: Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.
Clue: "primary"
Why it matters: Asks for the main purpose or function, not a secondary benefit. Eliminate answers that describe side-effects or partial functions.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The LAG configuration on the new FortiGate does not match the active cluster configuration.
The most likely cause is that the LAG configuration on the newly replaced FortiGate does not match the active cluster configuration. In an HA cluster, all LAG member interfaces (port3 and port4) must have identical settings—including LACP mode, speed, duplex, and VLAN membership—on both units. When the secondary FortiGate became primary and the replaced unit rejoined as secondary, any mismatch in the LAG configuration would cause the cluster to continuously renegotiate or flap the aggregated link, leading to intermittent traffic drops every few seconds as the HA cluster attempts to synchronize and stabilize the interface state.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✓
The LAG configuration on the new FortiGate does not match the active cluster configuration.
Why this is correct
Correct; mismatched LAG configuration can cause interface instability and traffic drops.
Clue confirmation
The clue words "most likely", "primary" in the question point toward this answer.
Related concept
Read the scenario before looking for a memorised answer.
✗
Session pickup is not enabled on the new FortiGate.
Why it's wrong here
Incorrect; session pickup is configured and working.
✗
The HA cluster is in split-brain state.
Why it's wrong here
Incorrect; the cluster status shows one primary and one secondary, not split-brain.
✗
The heartbeat interface is configured on the LAG, causing HA instability.
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates often attribute intermittent traffic drops to session pickup or split-brain issues, but the key clue is the periodic nature of the drops (every minute), which points to a configuration mismatch on the aggregated link rather than a session synchronization or HA state problem.
Trap categories for this question
Command / output trap
Incorrect; the cluster status shows one primary and one secondary, not split-brain.
Detailed technical explanation
How to think about this question
Under the hood, FortiGate HA uses a heartbeat mechanism to exchange configuration and session information. When a LAG interface is mismatched (e.g., different LACP key or port membership), the cluster's interface monitoring detects the inconsistency and may trigger a re-synchronization of the interface configuration, causing the LAG to briefly go down and come back up. In real-world scenarios, this often happens when a replacement unit is shipped with default settings or a different firmware version, and the LAG parameters (like LACP rate or port-channel mode) are not manually aligned with the existing cluster configuration, leading to periodic flapping that matches the HA sync interval.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A help-desk technician troubleshoots why a newly connected PC cannot reach shared printers on the same floor. The cable is good, the switch port is active, but the PC is in VLAN 20 and the printers are in VLAN 10. The uplink trunk only allows VLAN 10. A trunk being up does not mean every VLAN crosses it.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
High Availability and Diagnostics — This question tests High Availability and Diagnostics — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: The LAG configuration on the new FortiGate does not match the active cluster configuration. — The most likely cause is that the LAG configuration on the newly replaced FortiGate does not match the active cluster configuration. In an HA cluster, all LAG member interfaces (port3 and port4) must have identical settings—including LACP mode, speed, duplex, and VLAN membership—on both units. When the secondary FortiGate became primary and the replaced unit rejoined as secondary, any mismatch in the LAG configuration would cause the cluster to continuously renegotiate or flap the aggregated link, leading to intermittent traffic drops every few seconds as the HA cluster attempts to synchronize and stabilize the interface state.
What should I do if I get this NSE4 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Are there clue words in this question I should notice?
Yes — watch for: "most likely", "primary". Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.