NSE7 Enterprise Firewall and VDOMs Practice Question
A FortiGate HA cluster is configured in active-passive mode with VDOMs. The administrator wants to ensure that a specific VDOM (VDOM1) always runs on the primary unit unless that unit fails. Additionally, the administrator wants to minimize disruption during a failover. Which THREE configuration steps should be taken?
⚠ Common exam trap
Test-takers frequently confuse active-passive with active-active HA mode, incorrectly assuming that active-active is required for VDOM-specific control, when in fact the 'prefer' setting within active-passive mode achieves the desired behavior without allowing VDOMs to run on both units simultaneously.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Set the HA priority of the primary unit to a higher value (e.g., 200) than the secondary unit
In an active-passive HA cluster, setting a higher HA priority (e.g., 200) on the primary unit ensures it is elected as the active unit. This guarantees that VDOM1, which is not load-balanced, will run on the primary unit under normal conditions, as the higher priority value makes the primary unit preferred during the election process.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Set the HA priority of the primary unit to a higher value (e.g., 200) than the secondary unit
Why this is correct
Higher priority makes the unit preferred to be primary.
- ✗
Disable session pickup to speed up failover
Why it's wrong here
Disabling session pickup would drop sessions during failover.
- ✓
Configure VDOM load balance with 'prefer' setting for VDOM1 on the primary unit
Why this is correct
The 'prefer' setting ensures the VDOM runs on the primary unit normally.
- ✓
Enable session pickup and ensure session synchronization is configured
Why this is correct
Session pickup preserves sessions during failover.
- ✗
Enable active-active HA mode
Why it's wrong here
Active-active would allow both units to handle traffic, not prefer one for a VDOM.
Go deeper
Related to this question
About these practice questions
This NSE7 question is part of Courseiva's 940-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.