Auto-failover occurs in Option B (labeled "Leader unavailable; Leader not in quorum"). In a Distributed Vault or Conjur HA cluster using the Raft consensus algorithm, automatic promotion requires two conditions: the current Leader must be unreachable, and a healthy group of Standby nodes must possess a Quorum (majority). In this scenario, the Leader is network-partitioned away from the majority. The remaining Standby nodes still constitute a Quorum (2 out of 3 nodes), allowing them to safely elect a new Leader and maintain service availability.

Option A ("Leader unavailable; Leader in quorum") is incorrect because CyberArk logic prevents promotion if the unavailable Leader node is still part of the Quorum partition, avoiding potential data corruption or split-brain if the Leader service restarts.

Option C ("Leader available...") is incorrect because the system is operating normally; failover is only triggered during a failure.

Option D ("Leader unavailable; no quorum") is incorrect because the remaining nodes do not form a statistical majority (Quorum). Without a Quorum, the cluster cannot elect a new Leader and defaults to Read-Only mode.

CyberArk Docs, "Auto-failover | Secrets Manager Enterprise (Conjur)", Section: The quorum rule.

Quote: "Auto-failover does not occur in the following situations: ... If the Leader is in the quorum, promotion attempts are not started."

CyberArk Docs, "Auto-failover | Secrets Manager Enterprise (Conjur)", Section: How it works.

Quote: "If the number of nodes still able to communicate represents a majority (i.e. a quorum), those nodes make decisions about what to do about the failure."

CyberArk Docs, "Distributed Vaults during Vault failure", Section: Failover scenarios.

Context: Describes the promotion of a Candidate Vault when the Primary is unavailable and conditions (Quorum) are met.