NSE7 Troubleshooting and Diagnostics Practice Question
An administrator configures an HA cluster with two FortiGates using an FGCP active-passive configuration. After a failover, the new primary FortiGate shows all sessions are lost. The administrator has 'sync session' enabled in the HA configuration. What is the MOST likely reason sessions were not synchronized?
⚠ Common exam trap
Candidates often assume 'sync session' alone guarantees session pickup, overlooking that the heartbeat interface must have sufficient capacity to carry the synchronization traffic without drops.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The HA heartbeat interface is overloaded, causing session synchronization packets to be dropped
In an FGCP active-passive cluster, session synchronization relies on the heartbeat interface to transmit session-pickup packets from the active unit to the passive unit. If the heartbeat interface is overloaded (e.g., due to excessive traffic or misconfigured bandwidth), these packets can be dropped, causing the passive unit to lack the session table after a failover. The fact that 'sync session' is enabled but sessions are still lost points directly to a transport issue on the heartbeat link, not a configuration or policy problem.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The HA heartbeat interface is overloaded, causing session synchronization packets to be dropped
Why this is correct
Session synchronization uses the heartbeat link; if it is overloaded or has high latency, session sync packets can be lost, leading to session loss after failover.
- ✗
The passive unit's 'session-pickup' setting is disabled
Why it's wrong here
Session pickup is enabled by default in FGCP and does not affect synchronization from active to passive.
- ✗
The 'failover-monitor' interface is down on the active unit, preventing session sync
Why it's wrong here
Failover monitor interfaces are for link monitoring, not session sync.
- ✗
The 'session-ttl' setting is set to zero on the active unit
Why it's wrong here
Session TTL affects session timeout, not synchronization.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 940 original NSE7 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.