NSE4 High Availability and Diagnostics Practice Question
In an active-active HA cluster, which of the following must be identical on both FortiGate units?
⚠ Common exam trap
Many candidates confuse 'must be identical' with configuration values that are typically synchronized (like priority or hostname), but the virtual cluster ID is the only parameter that must match before cluster formation can occur, while others can differ or are overwritten during synchronization.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Virtual cluster ID
In an active-active HA cluster, the virtual cluster ID must be identical on both FortiGate units because it defines the cluster group and ensures that only units with the same ID can form an HA cluster. This ID is used in heartbeat packets to verify cluster membership and prevent accidental merging of separate clusters. Without a matching virtual cluster ID, the units will not recognize each other as part of the same HA group.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
HA priority
Why it's wrong here
HA priority is a configurable value used to elect the primary unit in a cluster, but it does not need to match across peers. In active-active HA, both units handle traffic, yet the primary is determined by the higher priority (with tiebreakers); setting different priorities allows administrators to control which unit takes the lead. Therefore, priority can differ and is not a setting that must be identical.
- ✗
Management IP address
Why it's wrong here
Each FortiGate in an HA pair must have a unique management IP address so that it can be individually reached for administration and monitoring. The management IP addresses are typically configured differently on each unit; in fact, the HA management interface is often set to a standalone address or managed via the cluster's virtual IP. Thus, management IPs are not required to match, and forcing them to match would cause IP conflicts on the network.
- ✓
Virtual cluster ID
Why this is correct
The virtual cluster ID is a mandatory HA parameter that must be the same on both units to ensure they belong to the same cluster and can synchronize correctly. This ID is used in heartbeat negotiation and for VDOM partitioning to separate multiple clusters on the same Layer 2 segment. If the virtual cluster IDs differ, the units will not form an HA cluster, even if all other settings are identical.
- ✗
Hostname
Why it's wrong here
Hostname is simply a local, administrative label used for device identification in the CLI or GUI; it has no impact on HA functionality. Each unit can have a different hostname without affecting the cluster's operation, as FortiGate does not use hostname to identify cluster peers. Therefore, hostnames do not need to match in an active-active HA cluster.
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE4 question from scratch — 773 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.