NSE4 High Availability and Diagnostics Practice Question
An administrator is configuring HA on two FortiGates. Both units have the same model and firmware. When they are connected, neither unit becomes active. The admin checks the HA status and sees that the cluster is not formed. What is the MOST likely cause?
⚠ Common exam trap
NSE4 often tests the misconception that HA cluster formation only requires matching model, firmware, and HA password, overlooking the necessity of a properly configured heartbeat interface.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The heartbeat interface is not configured
For a FortiGate HA cluster to form, the heartbeat interfaces must be properly configured and connected. The heartbeat interface is used for HA synchronization and monitoring between the units. If the heartbeat interface is not configured, the FortiGates cannot communicate, and the cluster will not form, leaving both units in a non-active state. Since both units have the same model and firmware, and the issue is that neither becomes active, the most likely cause is that the heartbeat interface is not configured.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The heartbeat interface is not configured
Why this is correct
In FortiGate HA, dedicated heartbeat interfaces are mandatory because they carry the Hello packets that allow units to discover each other and elect the active unit. If no heartbeat interface is configured, the FortiGates never exchange any HA traffic, so they remain in standalone mode even if all other HA settings, such as group ID and password, are correctly set. This is the most direct and fundamental cause of the inability to form a cluster.
- ✗
The management interface is used as a heartbeat
Why it's wrong here
While the management interface can be designated as a heartbeat interface in FortiGate configuration, it is not automatically used for HA; it must be explicitly assigned as a heartbeat port. If the administrator had properly configured the management interface as a heartbeat, the cluster would be able to detect the peer and form. Therefore, the statement that the management interface is used as a heartbeat is not a cause of failure—it would actually be a valid heartbeat configuration, so it is not the reason the HA is not working.
- ✗
The HA password is incorrect
Why it's wrong here
An incorrect HA password would cause an authentication failure between units, but only after the heartbeat interface has already allowed them to discover each other. With a password mismatch, you would typically see HA status indicating that the peer is detected but authentication fails, or the cluster fails to synchronize. Since the described issue is that the units are completely standalone with no cluster formation, a password mismatch is not the primary cause; without a heartbeat interface, the password is never even evaluated.
- ✗
The HA group-id does not match
Why it's wrong here
A mismatched HA group-id would cause the FortiGates to reject each other's heartbeat messages, but this presupposes that heartbeat traffic is actually being sent and received. If the group-ids differ, each unit still sees the peer's heartbeat packets but discards them because they don't belong to the same HA group, and both units would indeed remain standalone. However, when no heartbeat interface is configured, no HA traffic exists at all, so any group-id mismatch is irrelevant and cannot be the root cause of the failure.
Go deeper
Related to this question
About these practice questions
One of 773 original NSE4 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Fortinet exam blueprint
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.