Enterprise Firewall and VDOMs →easyMultiple ChoiceObjective-mapped

NSE7 Enterprise Firewall and VDOMs Practice Question

Exhibit

config system ha
    set mode a-p
    set group-name "HA_Cluster"
    set password ENC abcd1234
    set hbdev "port1" 100
    set session-pickup enable
    set session-pickup-connectionless enable
    set ha-mgmt-status enable
    config ha-mgmt-interfaces
        edit 1
            set interface "port2"
            set gateway 10.0.0.1
        next
    end
end

HA cluster status:

HA Health Status: OK
Model: FortiGate-100F
Mode: Active-Passive
Group: HA_Cluster
Debug: 0
npu-1: primary
npu-2: standby

Refer to the exhibit. An administrator has configured an active-passive HA cluster. After reviewing the configuration and status, the administrator wants to ensure that the management interface (port2) is accessible on both units using the same IP address. What additional configuration is required?

⚠ Common exam trap

A common mix-up: candidates confuse enabling ha-mgmt-status (which allows individual unit management) with configuring a virtual management IP (which provides a single shared IP for the cluster), leading them to incorrectly select Option B.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Configure a virtual management IP under the cluster settings

In an active-passive HA cluster, the management interface (port2) must be reachable on both units using the same IP address. This is achieved by configuring a virtual management IP (also known as a management IP address) under the cluster settings. The virtual management IP is assigned to the active unit and, upon failover, is automatically moved to the new active unit, ensuring continuous management access without requiring separate IP addresses per unit.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Set the gateway to 0.0.0.0
Why it's wrong here
The gateway is already configured correctly.
✗
Enable ha-mgmt-status on the secondary unit
Why it's wrong here
ha-mgmt-status is already enabled globally.
✓
Configure a virtual management IP under the cluster settings
Why this is correct
A virtual IP ensures the management interface is reachable via the same IP on both units.
✗
Disable session-pickup to free resources
Why it's wrong here
Session pickup is unrelated to management interface access.

Go deeper

NSE7 Enterprise Firewall and VDOMs Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question