NSE4 System and Network Administration Practice Question
A FortiGate is configured with two WAN interfaces in an active-passive HA cluster. The administrator notices that the passive unit is not synchronizing configuration changes from the active unit. What is the MOST likely cause?
⚠ Common exam trap
Candidates often assume synchronization is triggered manually or that HA mode affects sync behavior, but FortiGate HA relies entirely on a functional heartbeat link for automatic configuration replication, regardless of the active-passive or active-active mode.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The HA heartbeat interface is not configured or is down.
In an HA cluster, the heartbeat interface is responsible for synchronizing configuration changes and monitoring peer status between the active and passive units. If the heartbeat interface is not configured or is down, the passive unit cannot receive configuration updates from the active unit, leading to a synchronization failure. This is the most likely cause because without a functional heartbeat link, the cluster cannot maintain state or configuration consistency.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The HA heartbeat interface is not configured or is down.
Why this is correct
Configuration synchronization in a FortiGate HA cluster depends on the heartbeat link, which carries both liveness detection and configuration/session sync traffic. If the heartbeat interface is not physically assigned or is down, the primary cannot push configuration updates to the secondary, even though the cluster may still be considered up. This results in configuration drift while failover behavior appears normal, exactly matching the symptom described in the question.
- ✗
The passive unit has a different firmware version.
Why it's wrong here
For an HA cluster to form, both FortiGate units must run identical firmware builds. A firmware version mismatch is detected during the initial HA handshake, and the cluster either fails to form or the secondary is not admitted. In practice, the HA status would show an error, and configuration synchronization would never start because the cluster is not operational. Thus, a firmware mismatch would not merely cause unsynced configs; it would prevent the HA pair from working at all.
- ✗
The HA mode is set to active-active instead of active-passive.
Why it's wrong here
The HA mode (active-passive vs. active-active) determines traffic forwarding and load balancing, but it has no effect on the configuration synchronization mechanism. In both modes, the primary unit replicates configuration changes to the secondary over the heartbeat link automatically. Switching the mode would change traffic behavior, not the sync process, so this option cannot explain why configuration synchronization is failing. The symptom of unsynced configuration is independent of the HA mode.
- ✗
The administrator must manually trigger a sync from the active unit.
Why it's wrong here
FortiGate HA performs automatic, real-time configuration synchronization whenever a configuration change is committed on the primary unit. There is no requirement for an administrator to manually trigger a sync during normal operation; the propagation happens over the heartbeat link immediately. While manual sync commands exist for troubleshooting, their absence would never cause configuration drift. If the configurations differ, the root cause is always a communication failure or cluster state issue, not the lack of a manual step.
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE4 question from scratch — 282 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.