NSE4 System and Network Administration Practice Question
A FortiGate in an HA active-passive cluster is experiencing frequent failovers. The administrator checks the HA statistics and sees that the primary unit's heartbeat interface has a high error rate. What is the most likely cause?
⚠ Common exam trap
The trap here is that candidates often attribute frequent failovers to configuration mismatches (like passwords) or threshold settings, overlooking the physical-layer cause indicated by the high error rate on the heartbeat interface.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The heartbeat cable is faulty or the interface has a duplex mismatch
A high error rate on the heartbeat interface indicates physical-layer issues such as a faulty cable or duplex mismatch. In an HA active-passive cluster, the heartbeat link must be reliable and low-latency; errors cause packet loss, leading the primary unit to appear unresponsive and triggering a failover to the secondary unit.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The heartbeat cable is faulty or the interface has a duplex mismatch
Why this is correct
A faulty heartbeat cable or duplex mismatch causes physical-layer errors (CRC, late collisions, high error counts) on the dedicated HA link. Because the FortiGate continuously sends heartbeat packets to verify the peer's liveness, any corruption or drop of those packets is interpreted as a lost heartbeat. This repeated loss of consistency checks makes the cluster flap—each missed heartbeat triggers failover, then the link recovers and the cluster rejoins, causing frequent, disruptive failovers.
- ✗
The heartbeat interface is configured as a single link without redundancy
Why it's wrong here
Using a single heartbeat interface without redundancy is the default and fully supported HA setup; FortiGate does not require multiple HA links. Redundancy (e.g., an additional HA interface in a LAG or a dedicated management heartbeat) is optional and only protects against the physical link failing. Without redundancy, a single link fault would cause a one-time failover, not frequent flapping—so a single link is not the root cause of repeated failovers. The problem is the link's quality, not its quantity.
- ✗
The failover threshold is set too low
Why it's wrong here
FortiGate HA has no configurable 'failover threshold' for heartbeat loss; the cluster simply counts consecutive missed heartbeat packets and triggers failover after a fixed hold time. The 'failover-monitor' setting applies to monitored interfaces (e.g., WAN ports) with configurable thresholds, but it does not govern heartbeat reliability. Even if a threshold were tuned low, it would not cause failovers unless the heartbeat link itself is unreliable—so this is not a valid explanation for a flapping cluster.
- ✗
The HA configuration has mismatched passwords
Why it's wrong here
If the HA passwords on the two FortiGates do not match, the devices will reject each other's heartbeat packets during the authentication handshake, preventing the cluster from forming altogether. A cluster that has formed and is running with frequent failovers cannot be caused by mismatched passwords, because the initial cluster formation would have failed. The symptom of a password mismatch is an inability to synchronize or a split-brain scenario, not repeated clean failovers after successful HA establishment.
Go deeper
Related to this question
About these practice questions
One of 773 original NSE4 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.