NSE4 System and Network Administration Practice Question
You notice that the FortiGate HA cluster is not failing over when the primary unit loses power. The HA configuration shows 'set ha-priority 250' on the primary and 'set ha-priority 200' on the secondary. What is the most likely cause?
⚠ Common exam trap
Many exam-takers assume priority values alone determine failover behavior, but FortiGate HA failover requires a working heartbeat link to detect peer failure; without it, even a complete power loss goes unnoticed.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The HA heartbeat interface is not configured correctly or is down
The most likely cause is that the HA heartbeat interface is not configured correctly or is down (Option D). FortiGate HA relies on heartbeat packets exchanged over dedicated or VLAN interfaces to monitor peer status. If the heartbeat interface fails, the secondary unit cannot detect the primary's loss of power, so no failover occurs regardless of priority settings. The HA priority values (250 vs. 200) are valid and would normally cause the primary to be elected as the active unit, but a broken heartbeat link prevents failover detection.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The secondary unit has a lower priority, so it never takes over
Why it's wrong here
In Fortinet HA, priority determines which unit is preferred as the primary during the initial election and when both units are healthy. If the primary fails, the secondary unit, regardless of its lower priority, will detect the heartbeat loss and promote itself to primary. Therefore, lower priority does not prevent failover; it only makes the unit less preferred, not unable to take over.
- ✗
The password for HA synchronization is incorrect
Why it's wrong here
The HA password (or HA secret) is used to authenticate heartbeat and configuration synchronization packets between cluster members. An incorrect password would cause configuration sync to fail and might prevent the cluster from properly forming, but it does not directly block failover; in fact, if heartbeat authentication fails, the secondary may interpret the primary as unresponsive and assume the primary role, potentially causing split-brain rather than a failure to failover.
- ✗
The session pickup feature is disabled
Why it's wrong here
Session pickup (also called session failover or failover of session table) is a feature that synchronizes the state of TCP/UDP sessions to the backup unit so existing connections survive a failover. It has no effect on the failover trigger itself; the secondary will still become primary on a heartbeat loss even if session pickup is disabled. Disabling session pickup only means active session states are not preserved, not that failover cannot occur.
- ✓
The HA heartbeat interface is not configured correctly or is down
Why this is correct
The HA heartbeat interface is the dedicated link used by both units to exchange state and health information. If this interface is not configured correctly or is down, the secondary cannot reliably monitor the primary's heartbeat; in this scenario, the cluster may not even form, or if it did form, the secondary will not detect the primary's failure and will not initiate a failover. In some cases, a failed heartbeat with a still-functioning management plane can lead to split-brain, but a correctly working heartbeat is fundamental to failover detection and to avoid the cluster being stuck with an inactive primary.
Visual reference
Go deeper
Related to this question
About these practice questions
This NSE4 question is part of Courseiva's 282-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.