NSE8_813 sample questions

Question 1

A large enterprise is deploying a standalone FortiGate 7000 series chassis in a high-traffic data center, using Session-Aware Load Balancing (SLBC).

During a failure test, one of the processing modules (FPM) fails. The administrator notices that while new sessions are distributed to the remaining FPMs, a subset of long-lived TCP sessions was dropped and had to be re-established by the clients.

Based on the architecture of the 7000 series, what is the most likely cause of this behavior?

Accepted Answer

The failed FPM owned those sessions; FPMs in one chassis do not synchronize sessions with each other, so they are lost unless the chassis is in an FGCP HA cluster with session-pickup enabled.

Answer

The sessions were utilizing the management blade (FIM) for processing, which does not support session failover.

Answer

The traffic was classified as 'unmanageable' by the load balancer and was being handled by the primary FIM, which rebooted.

Answer

The FortiGate 7000 series only supports statless failover for UDP traffic, not TCP.

Question 2

An organization requires a high-availability architecture spanning two geographically separated data centers (DC A and DC B) connected by a Layer 2 metro link. The requirement is to utilize all available bandwidth on both sites simultaneously for outbound internet traffic while maintaining session continuity if one site fails completely.

Which Fortinet HA solution best fits this requirement, and what is a critical configuration constraint?

Accepted Answer

FortiGate Session Life Support Protocol (FGSP); traffic symmetry must be ensured or auxiliary sessions enabled.

Answer

FortiGate Clustering Protocol (FGCP) in Active-Active mode; latency between sites must be less than 10ms.

Answer

Virtual Router Redundancy Protocol (VRRP) with session-sync; the group ID must match on both units.

Answer

FortiGate Clustering Protocol (FGCP) in Active-Passive mode with 'override' enabled.

Question 3

You are designing a multi-tenant deployment on a single high-end FortiGate with one VDOM per tenant. All VDOMs send logs to the provider's central FortiAnalyzer using the global FortiAnalyzer settings. One tenant requires that its VDOM's logs be sent only to the tenant's own FortiAnalyzer.

Which configuration achieves this?

Accepted Answer

In the tenant VDOM, enable 'set faz-override enable' under 'config log setting', then enable and point 'config log fortianalyzer override-setting' to the tenant's FortiAnalyzer.

Answer

Configure a second FortiAnalyzer under 'config log fortianalyzer2 setting' in the global context; logs are then split by VDOM automatically.

Answer

Deploy FortiManager as a log relay between the FortiGate and the tenant's FortiAnalyzer.

Answer

Add the tenant FortiAnalyzer as a trusted host in the global admin settings.

Question 4

A customer requires a secure SD-WAN architecture where the hub FortiGate is located in AWS. They need to support 5000 spokes connecting via IPsec with ADVPN enabled. The Hub must reflect BGP routes between spokes.

What is the primary constraint to consider regarding the AWS instance size and type for this architecture?

Accepted Answer

The instance must support Enhanced Networking (ENA) and have sufficient vCPUs, as IPsec encryption and BGP route reflection are CPU-intensive.

Answer

AWS Security Groups do not support BGP, so GRE tunneling is required.

Answer

AWS does not support multicast, so ADVPN is not possible.

Answer

The Hub must be deployed in an Auto-Scaling Group to handle the tunnels.

Question 5

You are analyzing a performance issue on a FortiGate 3600E. The 'diagnose sys top' command shows the IPS engine consuming 99% CPU, but the NP6 processors show low utilization. The traffic consists primarily of large file transfers over HTTP.

Which configuration factor would prevent this traffic from being offloaded to the NP6 processor?

Accepted Answer

The firewall policy uses proxy-based inspection (proxy-based security profiles).

Answer

The firewall policy has 'flow-based' inspection enabled with an IPS profile.

Answer

The traffic is traversing two interfaces that belong to the same NP6 group.

Answer

The CP9 processor is overloaded and rejecting offload requests.

Question 6

A service provider is deploying a FortiGate in a multi-tenant environment using VDOMs. They need to ensure that a DDoS attack targeting one tenant (VDOM-A) cannot exhaust the session table capacity available to another tenant (VDOM-B).

Which configuration achieves this isolation?

Accepted Answer

Configure per-VDOM resource limits (config system vdom-property / set session ) so VDOM-A's sessions are capped and VDOM-B has guaranteed sessions.

Answer

Configure 'set strict-resource-limit enable' in the global system settings.

Answer

Enable NP7 hyperscale mode on VDOM-A only.

Answer

Use a separate physical FortiGate for VDOM-A.

Top vendors

Top exams

Free NSE8_813 sample questions

A service provider is deploying a FortiGate in a multi-tenant environment using VDOMs. They need to ensure that a DDoS attack targeting one tenant (VDOM-A) cannot exhaust the session table capacity available to another tenant (VDOM-B). Which configuration achieves this isolation?

6 more free samples are waiting