NSE4 High Availability and Diagnostics Practice Question
An administrator has configured an active-passive HA cluster. During a failover test, the standby unit becomes active but existing user sessions are lost, requiring users to re-establish connections. Which configuration change would prevent this behavior?
⚠ Common exam trap
NSE4 often tests the confusion between HA election/priority settings (override, priority) and stateful failover features (session pickup, session synchronization) — candidates pick priority or override thinking it preserves sessions, when only session pickup does.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable session pickup
In an active-passive FortiGate HA cluster, session pickup (also called session synchronization) is the feature that replicates the session table from the primary to the standby unit. Without it enabled, when failover occurs the standby unit has no knowledge of existing sessions and drops them, forcing users to reconnect. Enabling session pickup ensures the standby has a mirrored session table so established connections continue through the failover.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Lower HA priority on the primary
Why it's wrong here
Lowering HA priority on the primary only affects the election of which unit becomes active through the configured priority value; it does not trigger any transfer of firewall session state. In active-passive HA, the standby unit's session table is empty unless synchronous state replication is enabled, so changing priority would simply reselect a primary without providing session continuity. Since failover would still drop active connections, priority adjustment is an election mechanism, not a synchronization mechanism.
- ✓
Enable session pickup
Why this is correct
Enabling session pickup enables FortiOS to continuously replicate the active unit's session table, including NAT mappings and firewall state, to the standby unit over the synchronization link. On failover, the standby unit promotes itself to primary and already has all active sessions queued, enabling established connections to survive without re-handshake. This is the only option that directly addresses the requirement for stateful failover and is the standard way to preserve sessions in an active-passive HA cluster.
- ✗
Set HA override to enabled
Why it's wrong here
Setting HA override to enabled configures preemption, where a higher-priority unit will reclaim primary status after a failure is resolved, even if the current primary is healthy. This setting does not influence how or whether sessions are mirrored to the peer; it only changes the failover/rollback behavior. In fact, enabling override may cause additional failover events, which, without session pickup, would repeatedly interrupt traffic, so it is a management option rather than a session-continuity feature.
- ✗
Increase the heartbeat interval
Why it's wrong here
Increasing the heartbeat interval means the units will wait longer between heartbeat probes, which increases the time needed to detect a peer failure and delays any failover. This makes the HA cluster less responsive and does nothing to populate the standby's session table with active sessions. Since session synchronization is separate from heartbeat traffic, adjusting the interval cannot preserve connections; it only affects the failure-detection timer.
Go deeper
Related to this question
About these practice questions
One of 773 original NSE4 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on NSE4
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A FortiGate administrator has configured an active-passive HA cluster with two units. During a failover test, they notice that existing TCP sessions are dropped and must be re-established. What configuration change should the administrator make to ensure sessions are preserved during failover?
medium- ✓ A.Enable session synchronization between the cluster members
- B.Configure a dedicated heartbeat interface
- C.Enable HA override
- D.Increase the HA priority on the primary unit
Why A: Session synchronization (session sync) allows the active unit to share session table entries with the passive unit. During failover, the new active unit has the session table pre-populated, so existing sessions continue without interruption.
Variation 2. A FortiGate HA cluster is configured in active-passive mode with two units. The primary unit fails. The secondary unit takes over, but some established TCP sessions are dropped. What is the most likely cause?
medium- ✓ A.Session synchronization is not enabled
- B.The HA failover threshold is set too high
- C.The HA mode is active-passive
- D.The heartbeat interface is down
Why A: In an active-passive FortiGate HA cluster, the primary unit synchronizes session state (including TCP session tables) to the secondary unit so that upon failover, established sessions can continue without interruption. If session synchronization is not enabled, the secondary unit has no knowledge of existing sessions, so when it takes over, it drops all established TCP sessions because it has no session entries for them. Thus, the most likely cause is that session synchronization is disabled.
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Fortinet exam blueprint
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.