NSE4 High Availability and Diagnostics Practice Question
A FortiGate administrator has configured an active-passive HA cluster. After a failover event, the former primary unit comes back online and immediately takes over as primary again, causing another failover. The administrator wants the original primary to stay in standby until the current primary fails. Which setting should be configured?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Disable HA override on both units
HA override (set ha-override enable) causes a device to resume primary role when it becomes available with higher priority. Disabling override prevents this preemptive behavior.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable HA override on both units
Why it's wrong here
Enabling HA override on both units is incorrect because this setting explicitly permits a device with higher priority to take over as primary even if the current primary is healthy. In FortiOS HA, when override is enabled, the device that comes back online after a failure will preempt the active primary due to its higher priority, causing the exact failover and disruption the administrator wants to avoid. Thus, enabling override directly causes the undesired preemption behavior.
- ✗
Set the HA mode to active-active
Why it's wrong here
Setting the HA mode to active-active changes the operational model so that both units forward traffic simultaneously, but it does not alter the failover or failback logic that governs preemption. In active-active mode, the concept of primary/backup is blurred, yet the override setting still controls whether a recovered unit can force itself to become the active primary. Therefore, this option does not solve the issue of a unit automatically reassuming primary status after recovery.
- ✓
Disable HA override on both units
Why this is correct
Disabling HA override on both units is the correct solution because this setting prevents a unit with a higher priority from preempting the current primary as long as that primary is functioning normally. With override disabled, the active primary remains the primary until it actually fails, eliminating the automatic failback event that would otherwise occur when the recovered unit comes online. This ensures stable operation and avoids unnecessary traffic interruption in an active-passive HA deployment.
- ✗
Increase the HA priority on the primary unit
Why it's wrong here
Increasing the HA priority on the primary unit is not a valid solution because priority determines which unit is preferred for the primary role, not whether preemption occurs. If the primary already has a higher priority, raising it further would only make it more likely to preempt the other unit when it comes back online, intensifying the undesired failover behavior. The correct way to prevent preemption is to disable HA override, not to adjust priority values.
Go deeper
Related to this question
About these practice questions
This NSE4 question is part of Courseiva's 773-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.