Courseiva
Troubleshooting and DiagnosticsmediumMultiple ChoiceObjective-mapped

NSE7 Troubleshooting and Diagnostics Practice Question

During a failover test in an HA cluster, the primary FortiGate fails over to the secondary. After failover, some existing TCP sessions are dropped. What is the MOST likely reason?

⚠ Common exam trap

Candidates often assume active-passive HA always drops sessions or that routing changes are the default cause, but Fortinet specifically tests that session pickup must be explicitly enabled to preserve TCP sessions during failover.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

Session pickup is not enabled on the HA cluster

In an HA cluster, session pickup (also known as session synchronization) is responsible for replicating session tables from the primary FortiGate to the secondary. When failover occurs, if session pickup is not enabled, the secondary FortiGate has no knowledge of existing TCP sessions, causing them to be dropped. This is the most likely reason because the secondary device cannot forward traffic for sessions it does not recognize, even if the network topology remains unchanged.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • The failover caused a routing change

    Why it's wrong here

    Routing changes would not directly drop sessions; sessions would be re-established.

  • The session TTL expired during failover

    Why it's wrong here

    Failover is quick; TTL expiry is unlikely.

  • The HA mode is active-passive

    Why it's wrong here

    Active-passive supports session pickup; it's not the cause.

  • Session pickup is not enabled on the HA cluster

    Why this is correct

    Without session pickup, TCP sessions are lost on failover.

About these practice questions

This NSE7 question is part of Courseiva's 940-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.