NSE4 High Availability and Diagnostics Practice Question
An administrator is configuring an active-passive HA cluster on two FortiGate devices. The administrator wants to ensure that the cluster can fail over if the primary unit's internal interface (port1) fails, and also wants to minimize the chance of a split-brain scenario. Which two actions should the administrator take? (Choose two.)
⚠ Common exam trap
Many exam-takers confuse session synchronization or HA override with split-brain prevention, when actually split-brain is mitigated by redundant heartbeat links.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure two heartbeat interfaces and enable heartbeat failover.
To fail over on internal interface failure, port1 must be monitored. To minimize split-brain, redundant heartbeat interfaces should be configured, and heartbeat failover should be enabled so that if one heartbeat link fails, the other maintains communication. Session synchronization and active-active mode do not prevent split-brain, and HA override does not address heartbeat redundancy.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Configure two heartbeat interfaces and enable heartbeat failover.
Why this is correct
Configuring two heartbeat interfaces provides redundancy for heartbeat communication. If one heartbeat link fails, the other can still carry heartbeat packets, reducing the risk of split-brain. Enabling heartbeat failover allows the cluster to use the secondary heartbeat interface when the primary fails. This is a recommended practice to maintain cluster integrity and avoid both units becoming primary.
- ✓
Configure port1 as a monitored interface in the HA settings.
Why this is correct
Configuring port1 as a monitored interface ensures that the HA cluster tracks its link status. If port1 goes down, the cluster can trigger a failover to the secondary unit, fulfilling the requirement to fail over on internal interface failure. Monitored interfaces are essential for link-failure detection in HA, and this is a standard practice to maintain network availability.
- ✗
Enable HA override to force the primary unit to always be primary.
Why it's wrong here
HA override allows a unit with higher priority to preempt and become primary, but it does not prevent split-brain. In a split-brain scenario, both units may become primary regardless of override settings. Override is used to ensure a preferred unit becomes primary after a failover, but it does not provide redundancy for heartbeat links or prevent the cluster from splitting.
- ✗
Set the HA mode to active-active to avoid split-brain.
Why it's wrong here
Active-active mode does not prevent split-brain; in fact, split-brain can occur in both active-passive and active-active modes. Active-active allows all units to process traffic, but it still relies on heartbeat communication to maintain cluster state. Changing to active-active does not address the root cause of split-brain, which is loss of heartbeat connectivity.
- ✗
Enable session synchronization to prevent split-brain.
Why it's wrong here
Session synchronization ensures that session tables are synchronized between HA members, allowing seamless failover for established sessions. However, it does not prevent split-brain, which occurs when both units become primary due to lost heartbeat communication. Split-brain prevention requires redundant heartbeat links and proper heartbeat interface configuration, not session synchronization.
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE4 question from scratch — 773 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Fortinet exam blueprint
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.