NSE4 High Availability and Diagnostics Practice Question
A FortiGate administrator is configuring an active-passive HA cluster and needs to ensure that management access is available via a dedicated management IP address that does not fail over. Which three steps should the administrator take? (Choose three.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Assign an IP address to the management interface
To have a dedicated management IP that does not fail over, the administrator should configure a dedicated management interface (separate from HA heartbeat), assign an IP to it, and ensure the management access is configured on that interface. The management interface can be in a separate VDOM if desired.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Assign an IP address to the management interface
Why this is correct
The IP must be configured on the interface for management access.
- ✗
Enable 'set ha-mgmt-interface' on the management interface
Why it's wrong here
The 'ha-mgmt-interface' is for out-of-band management and still uses a floating IP; it does not provide a dedicated non-failover IP.
- ✗
Set the management interface to be part of the HA cluster management IP
Why it's wrong here
The cluster management IP is a floating IP that fails over; the goal is a non-failover IP.
- ✓
Ensure the management interface is not configured as a heartbeat interface
Why this is correct
If the management interface is also a heartbeat interface, it may be affected by HA failover.
- ✓
Configure a dedicated management interface (e.g., port3)
Why this is correct
A dedicated interface for management ensures it is not used for HA heartbeat or traffic.
Go deeper
Related to this question
About these practice questions
One of 282 original NSE4 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on NSE4
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An administrator is configuring an active-passive HA cluster and wants to ensure that the secondary unit can be monitored and managed directly via HTTPS even when it is not the primary. Which setting must be enabled?
easy- A.Use the same IP address for both units with different ports
- ✓ B.Enable 'set management-ip' on the HA configuration
- C.Configure a virtual IP address for management in the firewall policy
- D.Set 'ha-mgmt-status enable' on the interface
Why B: In active-passive HA, the management interface allows individual management of each unit. Enabling 'management interface' on a dedicated interface (or a VLAN) gives each unit its own IP address for out-of-band management, independent of the HA cluster IP.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.