VendorsExamsEnterprise
Support
Request an ExamContact UsFAQ

Fortinet NSE 8 - Recertification Written Exam Free Sample Questions

Description

Covers Fortinet security architecture and high-availability solutions, FortiGate and non-FortiGate hardware technology, advanced routing and VPN design, and SD-WAN architecture.

12 free sample questions135 in the full practice test

Try simulator

NSE8_813 Sample Questions

  1. Question 1

    Advanced

    Security Architecture · Chassis solutions 6000/7000 modules and architecture

    A large enterprise is deploying a standalone FortiGate 7000 series chassis in a high-traffic data center, using Session-Aware Load Balancing (SLBC).

    During a failure test, one of the processing modules (FPM) fails. The administrator notices that while new sessions are distributed to the remaining FPMs, a subset of long-lived TCP sessions was dropped and had to be re-established by the clients.

    Based on the architecture of the 7000 series, what is the most likely cause of this behavior?

    Answer and explanation

    Correct answer: C

    SLBC sends each session to one FPM, and that FPM holds the session state. FPMs in the same chassis do not synchronize sessions with each other, so when an FPM fails, the sessions it was processing are lost and the clients must reconnect. Only an FGCP HA cluster of two FortiGate 7000 chassis with session-pickup enabled keeps such sessions: the primary syncs its sessions to the secondary chassis, and an FPM failure makes the chassis with more working FPMs the primary.

  2. Question 2

    Advanced

    Security Architecture · Fortinet high-availability solutions

    An organization requires a high-availability architecture spanning two geographically separated data centers (DC A and DC B) connected by a Layer 2 metro link. The requirement is to utilize all available bandwidth on both sites simultaneously for outbound internet traffic while maintaining session continuity if one site fails completely.

    Which Fortinet HA solution best fits this requirement, and what is a critical configuration constraint?

    Answer and explanation

    Correct answer: C

    FGSP (Standalone Session Sync) allows two independent FortiGates to synchronize sessions without clustering them into a single logical entity (like FGCP). This allows active-active forwarding at Layer 3 across sites. However, because they are independent, asymmetric routing is a major issue; auxiliary sessions or strict symmetry must be managed.

  3. Question 3

    Intermediate

    Security Architecture · Demonstrate knowledge of Fortinet Security Fabric Solution deployments

    You are designing a multi-tenant deployment on a single high-end FortiGate with one VDOM per tenant. All VDOMs send logs to the provider's central FortiAnalyzer using the global FortiAnalyzer settings. One tenant requires that its VDOM's logs be sent only to the tenant's own FortiAnalyzer.

    Which configuration achieves this?

    Answer and explanation

    Correct answer: A

    By default, every VDOM uses the global FortiAnalyzer settings. To send one VDOM's logs to a different FortiAnalyzer, go into that VDOM and enable config log setting / set faz-override enable. Then configure config log fortianalyzer override-setting with set status enable and set server . The other VDOMs keep using the global FortiAnalyzer.

  4. Question 4

    Intermediate

    Security Architecture · Fortinet solutions for cloud security

    A customer requires a secure SD-WAN architecture where the hub FortiGate is located in AWS. They need to support 5000 spokes connecting via IPsec with ADVPN enabled. The Hub must reflect BGP routes between spokes.

    What is the primary constraint to consider regarding the AWS instance size and type for this architecture?

    Answer and explanation

    Correct answer: B

    In a cloud environment, encryption (IPsec) and control plane functions (BGP route reflection for 5000 peers) are heavily CPU dependent. Selecting an instance type with SR-IOV/ENA support and high CPU core count is critical. Unlike physical FortiGates with ASICs, VMs rely on the general-purpose CPU.

  5. Question 5

    Advanced

    Infrastructure · Demonstrate knowledge of FortiGate hardware technology

    You are analyzing a performance issue on a FortiGate 3600E. The 'diagnose sys top' command shows the IPS engine consuming 99% CPU, but the NP6 processors show low utilization. The traffic consists primarily of large file transfers over HTTP.

    Which configuration factor would prevent this traffic from being offloaded to the NP6 processor?

    Answer and explanation

    Correct answer: D

    Firewall sessions that include proxy-based security profiles are never offloaded to network processors and are always processed by the FortiGate CPU. Flow-based sessions (IPS, application control) can still be offloaded through NTurbo. Traffic shaping is not the blocker: NP6-offloaded sessions support offloading most types of traffic shaping.

  6. Question 6

    Intermediate

    Infrastructure · Demonstrate knowledge of FortiGate operation modes

    A service provider is deploying a FortiGate in a multi-tenant environment using VDOMs. They need to ensure that a DDoS attack targeting one tenant (VDOM-A) cannot exhaust the session table capacity available to another tenant (VDOM-B).

    Which configuration achieves this isolation?

    Answer and explanation

    Correct answer: D

    Per-VDOM resource limits isolate tenants. In the Global VDOM go to System > VDOM > Edit and set Override Maximum (and optionally Guaranteed) for Sessions. In the CLI this is config system vdom-property / edit / set session . Capping VDOM-A's maximum sessions stops a flood against VDOM-A from consuming the shared session table, and a guaranteed value reserves capacity for VDOM-B. System > Global Resources sets device-wide limits, not per-VDOM limits.

Register free for 6 more questions

Or unlock all 135 NSE8_813 questions with explanations, timed mode and flashcards.

Related practice tests

All Fortinet practice exams