NSE4 High Availability and Diagnostics Practice Question
A FortiGate administrator manages an active-passive HA cluster of two FGCP units. The administrator needs to upgrade the firmware on the cluster with minimal downtime. The administrator has already uploaded the new firmware image to both units. Which step should the administrator take next to ensure the secondary unit is upgraded first and the cluster remains available?
⚠ Common exam trap
The trap here is assuming that simply rebooting the secondary unit or using HA synchronization commands will upgrade its firmware, when in fact firmware must be installed locally on each unit using the restore image command.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Run 'execute ha manage 1' to access the secondary unit, then run 'execute restore image <firmware_file>' to install the new firmware.
In an active-passive HA cluster, upgrading firmware with minimal downtime involves upgrading the secondary unit first, then triggering a failover so the upgraded secondary becomes primary, and finally upgrading the original primary. Accessing the secondary via 'execute ha manage' and using 'execute restore image' is the correct method. This ensures the cluster remains available during the upgrade process.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Run 'execute ha manage 1' to access the secondary unit, then run 'execute restore image <firmware_file>' to install the new firmware.
Why this is correct
After uploading the firmware to both units, the administrator should log into the secondary unit via 'execute ha manage 1' and then use 'execute restore image' to install the new firmware. This upgrades the secondary first, then the primary can be upgraded later, minimizing downtime. This is the recommended HA firmware upgrade procedure.
- ✗
Run 'diagnose sys ha upgrade' to trigger the firmware upgrade process on the secondary unit.
Why it's wrong here
'diagnose sys ha upgrade' is not a valid command for initiating a firmware upgrade in a FortiGate HA cluster. The correct command is 'execute ha manage' to access the secondary, then perform the upgrade there. Using an invalid diagnose command would produce an error and not upgrade the cluster.
- ✗
Run 'execute ha synchronize start' to push the firmware from the primary to the secondary.
Why it's wrong here
The 'execute ha synchronize start' command is used to synchronize configuration and other data between HA members, not to push firmware images. Firmware is not transferred between units via HA synchronization. This command would not upgrade the secondary unit's firmware and is not the correct step after uploading the image.
- ✗
Run 'execute ha manage 1' to access the secondary unit, then run 'execute reboot' to reboot it into the new firmware.
Why it's wrong here
Rebooting the secondary unit does not automatically cause it to boot the new firmware image. FortiGate HA firmware upgrade requires using the HA upgrade process, not a simple reboot. Rebooting the secondary unit without initiating the upgrade would leave the cluster running the old firmware on both units, and the secondary might not come back with the new image.
Go deeper
Related to this question
About these practice questions
One of 773 original NSE4 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Fortinet exam blueprint
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.