NSE 4 - FortiOS 7.6 Administrator Exam Materials - Question #33 Discussion

Pretty sure the answer to this is A, since the primary firewall is set to failover if memory usage is above 70% for 50 seconds, and it's been 55.

When the memory on the primary reaches the threshold (70%) and stays like that for 50 seconds, then the
cluster elects a new primary.

Key facts from your reference (Fortinet docs):

1. Failover can be triggered by memory utilization exceeding the configured memory-failover-threshold.
2. Memory must stay above threshold for the full monitor-period (e.g. 60 seconds).
3. The check runs every memory-failover-sample-rate (default = 1 sec).
4. If memory usage > threshold continuously for that entire period → failover is triggered.
5. If a failover already occurred recently due to memory, the memory-failover-flip-timeout prevents flip-flopping.

Applying this to the scenario (observed for 55 seconds)
• The question explicitly says the outputs were observed for 55 seconds.
• Default memory-failover-monitor-period is 60 seconds.
• That means even if memory usage is above the threshold, the failover hasn’t yet triggered, because the condition wasn’t sustained for the full 60 seconds.
• So the primary is still the original FortiGate (no failover has occurred yet).

Since the memory threshold condition must persist for 60 seconds, and the admin only observed for 55 seconds, no memory-based failover has occurred yet. Therefore, HQ-NGFW-1 is still the primary, and its role is maintained because of the override setting ensuring it remains primary until an actual failover event occurs.

https://docs.fortinet.com/document/fortigate/7.0.0/new-features/823734/ha-failover-due-to-memory-utilization

the answer must be C bec the checking time is 55 but the configuration when reach to 60 sec will change the primary
C. HQ-NGFW-1 with the parameter memory-failover-flip-timeout setting
bec the memory-failover-flip-timeout is 60 sec

Answer is C according to this article https://docs.fortinet.com/document/fortigate/7.0.0/new-features/823734/ha-failover-due-to-memory-utilization
"If the FortiGate meets the memory usage conditions to cause failover, the failover does not occur if the last failover on that FortiGate was triggered by high memory usage within the timeout period (memory-failover-flip-timeout)."
"memory-failover-flip-timeout <integer>
The time to wait between subsequent memory based failovers, in minutes (6 - 2147483647, default = 6)."

Prety sure that correct answer is A

Answer is A. Reason is set memory-failover-monitor-period 50: The amount of time (in seconds) the memory must stay above the threshold before the failover occurs, preventing triggers from brief "spikes".
while set memory-failover-flip-timeout 60: A timer to prevent the cluster from "flapping" (bouncing back and forth) between units too quickly if memory levels fluctuate.

A or C?

A

Observed for 55 seconds

hier it ist very tricky
the admin has seen it as its 55 , that ist mean, not yet Failover

If memory > 70% → trigger failover
BUT only after flip-timeout (60 sec)
Given in question:

Observed for 55 seconds

33