Question 40
Two identical FortiGate 7.6.0 units have matching HA group settings but never discover a peer. The primary has heartbeat on port3 and port4, while the cabling connects its port3 to the peer port4 and vice versa. What physical correction is appropriate?
- Reconnect port3-to-port3 and port4-to-port4 on matching heartbeat networks, then confirm heartbeat reachability.
- Add a forward-traffic allow policy between internal users.
- Disable administrator trusted hosts on both units.
- Enable antivirus scanning on the cluster uplinks.
Explanation
Correct Answer
A:FGCP heartbeat interfaces communicate with the same selected heartbeat interface on the other member; cross-connected mismatched ports can prevent peer discovery.
Incorrect Answers
B:Heartbeat negotiation between FortiGate peers is not a user forwarding session selected by a LAN firewall policy.
C:Administrator trusted hosts constrain management login sources, not FGCP heartbeat interface pairing.
D:Content scanning a client session does not fix cross-connected HA heartbeat ports.
Question 41
Two members in an active-passive FGCP cluster have healthy heartbeat links. The primary loses physical carrier on an interface explicitly listed in `set monitor`; its partner has that interface up. Why can a role change occur without device power loss?
- FortiGuard rating events automatically determine primary when any IPS signature fires.
- The firewall policy order changes the cluster’s hardware unit priority every minute.
- A management HTTPS certificate expiry forces immediate primary reelection without checking HA settings.
- HA monitored-interface health participates in primary selection, so a monitored link failure can trigger failover while both FortiGates remain powered.
Explanation
Correct Answer
D:FGCP primary selection can run when a monitored link changes status; this differs from whole-device failure.
Incorrect Answers
A:FortiGuard/IPS detections are not HA monitored-link election criteria.
B:Forward-policy ordering does not automatically update HA device priority.
C:Certificate validity is not the monitored-interface link failure condition in the scenario.
Question 42
An active-passive FortiOS 7.6.0 cluster changes primary successfully, but a 30-minute HTTPS file transfer resets each time. HA heartbeat and configuration synchronization work. Which HA feature directly targets the lost TCP state?
- Raise the web-filter category timeout.
- Lower administrator HTTPS idle timeout.
- Enable supported FGCP session pickup and ensure session synchronization reaches the secondary member.
- Set the primary device priority to 255.
Explanation
Correct Answer
C:Heartbeat and configuration synchronization do not automatically preserve session state; session pickup replicates eligible TCP sessions for continuity during failover.
Incorrect Answers
A:Web filtering does not replicate session-table state to the standby member.
B:The broken flow is a client data session, not a GUI management session.
D:Election priority affects which member becomes primary, not whether standby has synchronized TCP sessions.
Question 43
A FortiGate cluster with override enabled has two healthy members. After a controlled recovery, the high-priority unit automatically becomes primary again, causing an unwanted second takeover. Which setting should the engineer evaluate?
- Disable session pickup to keep the current primary.
- Review HA override/preemption behavior and the intended election policy before changing device priorities.
- Increase DHCP lease time on the production VLAN.
- Turn off FortiGuard updates on the secondary member.
Explanation
Correct Answer
B:Override influences priority-driven preemption after recovery; a higher device priority alone does not prescribe a no-preemption failback policy.
Incorrect Answers
A:Session pickup influences TCP-state continuity, not the election rule that causes recovered-member preemption.
C:Client address leases are not FGCP primary selection inputs.
D:FortiGuard update state does not control override election behavior.
Question 44
An operations team must SSH directly into the secondary FortiGate while the shared cluster data interface remains active on the primary. Both units have an unused port8. Which design satisfies per-unit out-of-band management?
- Reserve port8 as an HA management interface and assign each member a distinct management IP and appropriate management gateway.
- Add port8 only as a heartbeat interface with the shared cluster IP.
- Enable the same management IP on both units as ordinary shared production interfaces.
- Use firewall policy destination NAT to reach the standby unit management process.
Explanation
Correct Answer
A:Reserved HA management interface settings are member-specific and unsynchronized; this permits direct management of each unit without moving the shared data-plane address.
Incorrect Answers
B:A heartbeat port is for cluster communication, not a per-member routed administrative address.
C:Duplicated per-unit management addresses defeat independently addressable out-of-band access.
D:A forwarding VIP cannot replace reserved member-specific administrative interface settings.
Question 45
After a FortiOS 7.6.0 primary adds a shared firewall address object, the standby shows out-of-sync. Select TWO useful first actions that target configuration divergence rather than member-local exceptions.
- Compare HA configuration synchronization status/checksum outputs and locate the divergent shared section.
- Make both units use an identical hostname to fix the checksum.
- Disable heartbeat before comparing configuration so both units elect themselves primary.
- Increase the outside interface MTU as the sole checksum repair.
- Confirm the primary and standby contain the same intended shared address object after supported synchronization.
Explanation
Correct Answer
A:A checksum/status comparison narrows the mismatched shared configuration rather than guessing based on a single GUI badge.
E:The actual security object must be consistent on both members; a healthy heartbeat by itself does not establish policy-object equality.
Incorrect Answers
B:Hostnames are documented member-local exceptions and do not correct a shared address-object mismatch.
C:Breaking heartbeat introduces cluster instability and prevents reliable synchronization investigation.
D:Forwarding MTU does not explain a changed shared address object missing from one member.
Question 46
A two-member FGCP cluster must move to a supported FortiOS 7.6.x build with minimum service disruption. Which prechange control addresses HA sequencing instead of blindly rebooting both peers?
- Back up the cluster configuration, verify the supported Fortinet firmware path and cluster upgrade behavior, and monitor member roles and synchronization during the change.
- Upgrade both appliances with unrelated firmware builds at the same time.
- Disable all heartbeat links throughout the upgrade.
- Increase SD-WAN rule priority to force a software install.
Explanation
Correct Answer
A:A documented supported upgrade path and verified backup allow a staged, monitored cluster transition; simultaneous unmanaged restarts remove redundancy.
Incorrect Answers
B:FGCP requires matching supported firmware; inconsistent builds or uncontrolled simultaneous reboots risk losing cluster service.
C:Loss of HA communication can create separate primaries and does not implement safe sequencing.
D:Steering selection is not the HA firmware-install or member-sync procedure.
Question 47
An HA pair runs EXACTLY FortiOS 7.6.0, with no newer-version virtual-serial HA license feature in use. The secondary unit shows an expired FortiGuard service even though the primary has an active contract. What must operations verify?
- Enable `session-pickup` to synchronize license ownership from primary to secondary.
- Change the HA heartbeat group ID until a FortiGuard subscription appears.
- Reorder the firewall policies so the secondary receives a copy of the primary’s service contract.
- Verify FortiCare registration and the appropriate service entitlement for each applicable physical member; FGCP configuration sync is not itself a license grant.
Explanation
Correct Answer
D:On FortiOS 7.6.0, do not assume the later 7.6.1 HA vSN single-license capability. The active member’s contract does not automatically license the other via configuration synchronization.
Incorrect Answers
A:Session-pickup replicates selected traffic state, not FortiCare service contract assignment.
B:HA group IDs affect clustering/virtual MAC derivation, not independent FortiGuard entitlement registration.
C:Forward security policy ordering has no authority over Fortinet account registration and licensing.
Question 48
Two SEPARATE FGCP clusters share the same Ethernet broadcast domain. Their active interfaces show identical HA virtual MAC addresses, and intermittent ARP churn occurs. Which cluster setting should be checked for a collision?
- Enable FGCP session pickup between unrelated clusters to avoid MAC duplication.
- Change the primary device administrator password on both clusters to the same value.
- Assign unique HA group IDs or correct the supported virtual MAC scheme and verify current virtual MAC addresses on both clusters.
- Add identical route distances on both clusters and ignore Ethernet addresses.
Explanation
Correct Answer
C:FortiOS can derive HA VMAC values from group ID and cluster identifiers; duplicate group IDs on one broadcast domain can produce MAC conflicts.
Incorrect Answers
A:Session sync does not create distinct L2 MAC identities across independent HA clusters.
B:Administrator password equality does not define the VMAC used in the network.
D:Routing costs do not fix an L2 VMAC collision detected by switch/ARP tables.
Question 49
Two same-model FortiGate 7.6.0 appliances have identical HA passwords and group identifiers, but each reports itself as a single-member cluster. On inspection, port3 heartbeat frames from each unit are sent into different isolated VLANs. Which root cause best explains the split?
- The primary has a lower administrator HTTPS timeout.
- The HA peers are isolated at the heartbeat Layer 2 network, so they cannot exchange FGCP heartbeat/cluster discovery traffic.
- The web-filter subscription is not synchronized to the secondary.
- A forward accept policy lacks source NAT.
Explanation
Correct Answer
B:FGCP membership depends on a working common heartbeat path; matching group attributes cannot compensate for VLAN isolation.
Incorrect Answers
A:Management GUI idle settings do not isolate FGCP heartbeat frames at Layer 2.
C:Per-member subscriptions can affect security updates but do not explain complete absence of HA heartbeat reachability.
D:Forwarded client NAT is not the heartbeat peer-discovery mechanism.
Question 50
For a FortiOS 7.6.0 FGCP cluster, select THREE HA configuration inputs that Fortinet documents as participating in primary-unit selection when members or monitored-link states change.
- The number of web-filter URL categories listed in the security profile.
- The monitored-interface status for configured HA monitor ports.
- Each member’s HA device priority value.
- The HA override setting on members.
- The DHCP lease time assigned to laptop clients.
- The newest FortiAnalyzer log upload time as the controlling tie-breaker.
Explanation
Correct Answer
B:A monitored-link failure or recovery can trigger primary-unit selection and influence which unit remains eligible.
C:Primary selection considers configured device priority, including with override enabled.
D:Override changes the relative weighting of priority and uptime during unit selection.
Incorrect Answers
A:Application web-filter category definitions are not FGCP device election inputs.
E:Client DHCP lease duration does not decide the primary FortiGate member.
F:Remote log transmission timing is not the documented FGCP election criterion.
Fortinet NSE 4 - FortiOS 7.6 Administrator (NSE4_FGT_AD-7.6) Practice Tests