Key Characteristics of FortiGate Active-Passive HA
An administrator is configuring a FortiGate HA cluster in active-passive mode. Which two statements are correct about this configuration?
Quick Answer
The answer is that session synchronization is configured to maintain stateful failover. This is correct because in an active-passive HA cluster, only the active unit processes and forwards traffic while the passive unit remains in standby, so replicating session tables from the active to the passive unit ensures that when a failover occurs, established connections are seamlessly preserved without interruption. On the Fortinet NSE 4 Network Security Professional exam, this concept tests your understanding of how FortiGate HA achieves high availability without load sharing, and a common trap is confusing active-passive with active-active, where both units forward traffic. Remember the memory tip: “Passive waits, active creates; sync the sessions to seal the fates.”
⚠ Common exam trap
Test-takers frequently confuse active-passive with active-active mode, mistakenly thinking both units can forward traffic simultaneously, or they assume the cluster IP is shared by both units at all times.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
One unit is active and forwards traffic, while the other is passive and does not forward traffic unless a failover occurs.
In an active-passive HA cluster, only the active unit processes and forwards traffic, while the passive unit remains in standby mode and does not forward traffic unless a failover occurs. This ensures high availability without load sharing. Additionally, session synchronization is configured to replicate stateful session information from the active to the passive unit, enabling seamless failover without disrupting established sessions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The cluster IP address is assigned to both units simultaneously.
Why it's wrong here
The cluster IP is only on the active unit.
- ✓
One unit is active and forwards traffic, while the other is passive and does not forward traffic unless a failover occurs.
Why this is correct
This defines active-passive HA.
- ✗
Both units can forward traffic simultaneously.
Why it's wrong here
That describes active-active HA.
- ✗
Heartbeat interfaces are optional.
Why it's wrong here
Heartbeat is required for HA.
- ✓
Session synchronization is configured to maintain stateful failover.
Why this is correct
Session sync is critical for seamless failover.
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE4 question from scratch — 282 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on NSE4
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An administrator is configuring a FortiGate HA cluster in active-passive mode with two units. Which two conditions must be met for failover to occur? (Choose two.)
hard- ✓ A.A monitored interface on the primary unit goes down
- ✓ B.The primary unit loses all heartbeat communication with the secondary unit
- C.The secondary unit receives a higher priority configuration
- D.The primary unit's CPU usage exceeds 90%
- E.The primary unit stops sending session synchronization packets
Why A: In an active-passive FortiGate HA cluster, failover occurs only when the primary unit loses heartbeat communication with the secondary unit (option B) or a monitored interface on the primary unit goes down (option A). Options C, D, and E are not valid triggers for automatic failover. Therefore, only two of the listed options are correct.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.