In a Google Cloud Platform (GCP) environment, an active-passive FortiGate HA cluster integrated with a passthrough load balancer (such as a Regional External TCP/UDP Load Balancer) relies on a health check mechanism for failover. The load balancer continuously sends health check probes to both FortiGate instances. The HA cluster is configured so that only the active unit responds successfully to these probes. When a failover occurs, the newly promoted passive unit becomes active and begins responding to the health checks, while the former active unit stops. The GCP load balancer detects this change in health status and automatically redirects all traffic to the new active instance. This health check is the critical component that enables traffic redirection and successful failover.

(This section assumes plausible incorrect options for a question of this nature.)

A. Configuring a service account with permissions to modify routes: This is the critical mechanism for route-based HA failover, not for failover using a passthrough load balancer, which relies on health checks.

B. Enabling session pickup in the HA configuration: Session pickup provides stateful failover, which is important for user experience but not the fundamental mechanism that makes the traffic path switch to the new active unit.

D. Assigning alias IP ranges to the FortiGate interfaces: Alias IPs are used in GCP for various networking scenarios, but they are not the primary mechanism that triggers the load balancer to redirect traffic during an HA failover.

1. Fortinet Document Library, "Deploying FortiGate-VM active-passive HA on Google Cloud Platform" (for FortiOS 7.4.1):

In the section "Regional external load balancer", the document states, "The load balancer sends health checks to both FortiGate-VM instances. Only the active FortiGate-VM instance responds to the health check. The passive instance does not. This ensures that the load balancer only sends traffic to the active instance." This directly confirms the health check's critical role.

2. Fortinet Document Library, "FortiGate-VM on GCP Administration Guide" (for FortiOS 7.4.1):

In the "High Availability" chapter, under the section for "Active-passive HA with an external load balancer", the guide details the configuration of a secondary IP on the FortiGate interface with probe-response enabled. It explains that this IP is used specifically for the load balancer's health check and is only active on the primary HA unit. This reinforces that the health check response is controlled by the HA status and is the trigger for the load balancer.