NSE4 High Availability and Diagnostics Practice Question
In an active-active HA cluster, session synchronization is configured. A new session is created on the primary unit. When does the secondary unit learn about this session?
⚠ Common exam trap
NSE4 often tests the misconception that HA synchronization happens on a fixed heartbeat schedule, when in fact session state is replicated continuously and asynchronously as sessions are created or updated.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Within a few milliseconds to seconds after creation
In an active-active HA cluster, FortiGate performs real-time session synchronization (session-pickup) between cluster members over the HA heartbeat link. When a new session is created on the primary, the session table entry is pushed to the secondary almost instantly — typically within milliseconds, though under load it can take up to a few seconds. This ensures that if a failover occurs, existing sessions continue without being dropped.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
During the next heartbeat interval
Why it's wrong here
FortiGate cluster heartbeat packets only verify peer liveness and are exchanged on the dedicated HA heartbeat interface, typically every 200 ms; they do not carry session table data. Session synchronization runs as a separate mechanism over a dedicated TCP session (port 5199) and occurs on its own schedule or when session state changes, so waiting for a heartbeat interval would delay or miss the sync event entirely.
- ✗
After the session is closed
Why it's wrong here
Session synchronization is designed to maintain an active session on the secondary unit so it can take over immediately if the primary fails. Once a session is closed, the source/destination NAT mappings and state entries are removed and there is no longer any need for the peer to know about it; syncing after closure would both waste bandwidth and create stale table entries, making this option incorrect.
- ✓
Within a few milliseconds to seconds after creation
Why this is correct
In FortiGate active-active HA, session synchronization is triggered periodically (default every 200 ms) as well as on immediate state changes such as session setup or teardown. Because of this periodic timer, a newly created session is typically copied to the secondary within a few hundred milliseconds to a couple of seconds, giving the secondary nearly up-to-date state without the performance overhead of instantaneous synchronous replication on every packet.
- ✗
Immediately upon session creation
Why it's wrong here
While FortiGate HA can be configured to synchronize session state changes as they occur, the default operation is periodic synchronization with a 200 ms timer, meaning there is always a minimal but measurable delay between creation and replication. Saying 'immediately' implies zero-latency, guaranteed-at-the-instant behavior, which is not accurate for normal active-active configurations; the synchronization is near-real-time but not instantaneous.
Go deeper
Related to this question
About these practice questions
This NSE4 question is part of Courseiva's 773-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Fortinet exam blueprint
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.