NSE8_880 sample questions

Question 1

You are designing a High Availability (HA) cluster for a financial institution that requires zero packet loss during failover. You decide to implement FortiGate Session Life Support Protocol (FGSP) across two geographically separated data centers. Which of the following requirements must be met to ensure successful Layer 3 session synchronization between the peers?

Accepted Answer

The FortiGate devices must be the same model and running the same firmware version

Accepted Answer

The peer-ip command must be configured to point to the remote peer's interface IP

Answer

Both devices must be configured with the same HA group-id and priority

Answer

External load balancers must be configured to distribute traffic based on source IP only

Question 2

A network administrator is troubleshooting an SD-WAN deployment where traffic is not switching to the secondary link despite the primary link exceeding the latency threshold. The administrator reviews the SD-WAN rule configuration shown below:

config system sdwan
config service
edit 1
set mode sla
set protocol 6
set start-port 443
set end-port 443
set dst "all"
set src "all"
config sla
edit "latency_check"
set id 1
next
end
set priority-members 1 2
next
end
end

What is the most likely cause of the issue?

Accepted Answer

The 'latency_check' SLA object is not properly linked to a Performance SLA that defines the threshold

Answer

The SD-WAN rule is missing the 'set hold-down-time' command

Answer

The member interface priorities have not been manually assigned in the interface configuration

Answer

The 'set mode sla' should be 'set mode priority' for failover to work

Question 3

You are managing a FortiManager device with ADOMs enabled. You need to upgrade the firmware of a managed FortiGate cluster from v7.2.4 to v7.4.1. When you attempt to perform the upgrade via the FortiManager Device Manager, the option is grayed out. What is the primary reason for this restriction?

Accepted Answer

The ADOM version is set to 7.2 and must be upgraded to 7.4 before the devices can be upgraded

Answer

The FortiGate devices are in an HA cluster and must be upgraded individually

Answer

The FortiManager itself is running v7.2 and cannot manage v7.4 devices

Answer

The administrator does not have the 'System Admin' profile

Question 4

In a FortiGate FGCP High Availability cluster, which command would you use to verify if the secondary unit is synchronized with the primary unit's configuration and is ready to take over?

Accepted Answer

diagnose sys ha checksum cluster

Answer

get system ha status

Answer

diagnose sys ha status

Answer

execute ha synchronize

Question 5

You are configuring a FortiGate in a multi-tenant environment using VDOMs. You need to ensure that a specific customer VDOM (VDOM-A) does not consume more than 20% of the total available sessions on the device. Which configuration context should you use to apply this limit?

Accepted Answer

Global configuration > config system vdom-property

Answer

Global configuration > config system resource-limits

Answer

Global configuration > config global

Answer

VDOM-A configuration > config system session-limit

Question 6

An organization uses Auto Discovery VPN (ADVPN) to connect 50 branch offices. A shortcut tunnel has been successfully established between Branch A and Branch B. However, users in Branch A cannot access a specific UDP application in Branch B, although ICMP works fine.

Reviewing the debug flow on Branch A shows:
`id=20085 trace_id=1 func=print_pkt_detail line=5824 msg="vd-root:0 received a packet(proto=17, 10.1.1.2:4500->10.2.2.2:4500) from local. type=1, code=0, ...`

What is the most likely cause of this issue?

Accepted Answer

The firewall policy allowing traffic between branches does not include UDP services

Answer

The ADVPN shortcut route has a higher administrative distance than the Hub route

Answer

UDP traffic cannot traverse ADVPN shortcut tunnels due to lack of state synchronization

Answer

The Phase 2 Quick Mode selectors are mismatched for the UDP traffic

Top vendors

Top exams

Free NSE8_880 sample questions

You are managing a FortiManager device with ADOMs enabled. You need to upgrade the firmware of a managed FortiGate cluster from v7.2.4 to v7.4.1. When you attempt to perform the upgrade via the FortiManager Device Manager, the option is grayed out. What is the primary reason for this restriction?

In a FortiGate FGCP High Availability cluster, which command would you use to verify if the secondary unit is synchronized with the primary unit's configuration and is ready to take over?

You are configuring a FortiGate in a multi-tenant environment using VDOMs. You need to ensure that a specific customer VDOM (VDOM-A) does not consume more than 20% of the total available sessions on the device. Which configuration context should you use to apply this limit?

6 more free samples are waiting