• Home
• Fortinet Exams
• NSE8_812 - Fortinet NSE 8 Written Exam

NSE8_812 Fortinet Practice Test Questions and Exam Dumps

Question No 1:

What is the Forward Error Correction behavior if the SD-WAN network traffic download is 500 Mbps and has 8% of packet loss in the environment?

A. 1 redundant packet for every 10 base packets
B. 3 redundant packet for every 5 base packets
C. 2 redundant packet for every 8 base packets
D. 3 redundant packet for every 9 base packets

Answer: C

Explanation:

Forward Error Correction (FEC) is a technique used in networking to ensure reliable data transmission, especially in environments where packet loss is an issue. In SD-WAN networks, FEC helps recover lost packets by sending redundant packets that can be used to reconstruct lost or corrupted packets.

In the scenario given:

• Download traffic is 500 Mbps.

• Packet loss in the environment is 8%.

FEC works by sending redundant packets to help recover from packet loss. The FEC behavior typically follows a specific ratio of base (original) packets to redundant packets. To calculate the ratio, we use the formula related to packet loss percentage:

• A packet loss of 8% means that 8% of the packets may be lost in transmission.

• FEC generally compensates for this by sending additional redundant packets that allow the receiver to reconstruct the original packets in case of loss.

The most common ratio used in many systems to handle an 8% loss is a ratio of 2 redundant packets for every 8 base packets. This means for every 8 packets transmitted, 2 additional redundant packets are sent to ensure that if any packets are lost, the missing data can still be reconstructed by the receiver. This corresponds to Option C.

Now, let’s consider the other options:

• Option A: 1 redundant packet for every 10 base packets would not be sufficient to compensate for 8% packet loss. It’s too sparse.

• Option B: 3 redundant packets for every 5 base packets represents a high redundancy ratio, but it’s an overcompensation for an 8% loss, which is unnecessary.

• Option D: 3 redundant packets for every 9 base packets would also offer more redundancy than required, but it doesn’t align with the typical FEC calculations for an 8% packet loss.

Question No 2:

You are running a diagnose command continuously as traffic flows through a platform with NP6 and you obtain the following output:

Given the information shown in the output, which two statements are true? (Choose two.)

A. Enabling bandwidth control between the ISF and the NP will change the output
B. The output is showing a packet descriptor queue accumulated counter
C. Enable HPE shaper for the NP6 will change the output
D. Host-shortcut mode is enabled
E. There are packet drops at the XAUI

Answer: B, E

Explanation:

Given the diagnostic context and the NP6 platform, let's analyze the options:

• B. The output is showing a packet descriptor queue accumulated counter: The NP6 (Network Processor 6) is a platform used for high-performance network processing. The output from a diagnostic command related to NP6 often involves information regarding packet processing, queues, or traffic handling. Packet descriptor queues are typically part of the data structure used to manage incoming or outgoing packets. If the diagnostic output is showing an accumulated counter, it is likely referring to a packet descriptor queue that tracks the number of packets processed or queued. This would explain the behavior described in the option.

• E. There are packet drops at the XAUI: XAUI (10-Gigabit Attachment Unit Interface) is often used in high-speed Ethernet connections, such as those found in NP6 or other network processors. If there is an issue related to packet drops at XAUI, this can indicate that the interface is experiencing congestion or other problems leading to dropped packets. Packet drops at XAUI would likely show up in diagnostic outputs as a result of insufficient bandwidth or buffer capacity at the interface, which is consistent with the option that indicates packet drops at XAUI.

Now let's look at the other options:

• A. Enabling bandwidth control between the ISF and the NP will change the output: The ISF (Interface Switching Fabric) and NP (Network Processor) are components of the platform's packet-processing system. Enabling bandwidth control could affect the traffic flow and potentially impact diagnostic output. However, this statement does not directly correspond to the immediate symptoms or counters typically shown in the diagnostic output for packet descriptor queues or XAUI packet drops.

• C. Enable HPE shaper for the NP6 will change the output: HPE (High-Performance Ethernet) shaper is a mechanism that could regulate traffic shaping to prevent congestion and improve packet flow. However, enabling the HPE shaper is more related to traffic management and rate-limiting rather than directly affecting the diagnostic counters related to packet descriptor queues or XAUI packet drops in this context.

• D. Host-shortcut mode is enabled: Host-shortcut mode is a configuration mode that allows direct processing paths for certain types of traffic in network processors. While this mode could impact the way traffic is processed, the diagnostic output in this context seems more focused on the packet descriptor queue and XAUI drops, which are not directly tied to the host-shortcut mode setting.

In conclusion, the correct answers are B and E because they are directly related to the observed behavior in the diagnostic output: the presence of packet descriptor queues and the indication of packet drops at XAUI.

Question No 3:

Which two methods are supported for importing user-defined Lookup Table Data into the FortiSIEM? (Choose two.)

A. Report
B. FTP
C. API
D. SCP

Answer: B, C

Explanation:

FortiSIEM supports various methods for importing user-defined Lookup Table Data, which is essential for enriching event data and making event correlation more effective. When dealing with large datasets or dynamic updates, importing lookup table data in an efficient and reliable manner is key. Let’s go through the options to determine which methods are supported:

A. Report:
Reports in FortiSIEM are typically used for generating and viewing system data or event reports and are not designed for directly importing user-defined lookup tables. Therefore, this is not a supported method for importing lookup table data.

B. FTP:
FortiSIEM supports FTP (File Transfer Protocol) for importing data, including user-defined Lookup Table Data. Using FTP, files containing lookup data can be transferred to the FortiSIEM system. This method is commonly used for handling large volumes of data and integrating with external systems.

C. API:
FortiSIEM also supports API (Application Programming Interface) for importing user-defined Lookup Table Data. Using the API, users can automate the process of importing data and integrate FortiSIEM with external applications or scripts to populate lookup tables dynamically. The API method is ideal for scenarios requiring real-time or programmatic interaction with the system.

D. SCP:
While SCP (Secure Copy Protocol) is a secure method of transferring files between systems, FortiSIEM does not use SCP specifically for importing user-defined lookup tables. SCP is often used for secure file transfers but is not listed as a primary method for importing lookup table data into FortiSIEM.

In summary, the correct methods for importing user-defined Lookup Table Data into FortiSIEM are B. FTP and C. API. These methods provide secure and flexible ways to manage and import lookup data.

Question No 4:

What is the benefit of using FortiGate NAC LAN Segments?

A. It provides support for multiple DHCP servers within the same VLAN
B. It provides physical isolation without changing the IP address of hosts
C. It provides support for IGMP snooping between hosts within the same VLAN
D. It allows for assignment of dynamic address objects matching NAC policy

Answer: B

Explanation:

FortiGate NAC (Network Access Control) LAN Segments are used to segment and control network traffic based on security policies without requiring changes to the IP addresses of devices. This provides physical isolation between devices within a network while maintaining the same IP address range. This is particularly beneficial in environments where devices need to be isolated for security purposes, but there is no desire to reconfigure IP addressing schemes.

Here's why B is the correct answer:

• B. It provides physical isolation without changing the IP address of hosts: This is the key benefit of using FortiGate NAC LAN Segments. It allows for the isolation of devices into distinct segments for security purposes (for example, separating devices by role or trust level), while the IP addresses of the devices do not need to be altered. This means you can enforce security policies without causing disruption to existing IP configurations.

Now, let’s review the other options:

• A. It provides support for multiple DHCP servers within the same VLAN: While FortiGate can support multiple DHCP servers, this is not the main function of NAC LAN Segments. The primary purpose of NAC LAN Segments is to isolate traffic and control network access, not specifically to enable multiple DHCP servers in the same VLAN.

• C. It provides support for IGMP snooping between hosts within the same VLAN: IGMP (Internet Group Management Protocol) snooping is used to manage multicast traffic in a network. While FortiGate devices may support IGMP snooping, it is not directly related to the function of NAC LAN Segments. NAC LAN Segments focus more on security and isolation rather than managing multicast traffic.

• D. It allows for assignment of dynamic address objects matching NAC policy: While dynamic address objects can be used in FortiGate for NAC policy enforcement, the primary benefit of NAC LAN Segments is the physical isolation of devices without changing their IP address. The dynamic assignment of address objects is a feature of FortiGate's policy management, but it is not the central benefit of using NAC LAN Segments.

In summary, the benefit of using FortiGate NAC LAN Segments is physical isolation of hosts, allowing network administrators to apply security controls without requiring changes to the IP addresses of the hosts. This approach simplifies network management while enhancing security.

Question No 5:

You are troubleshooting a FortiMail Cloud service integrated with Office 365 where outgoing emails are not reaching the recipients’ mail. What are two possible reasons for this problem? (Choose two.)

A. The FortiMail access control rule to relay from Office 365 servers FQDN is missing
B. The FortiMail DKIM key was not set using the Auto Generation option
C. The FortiMail access control rules to relay from Office 365 servers public IPs are missing
D. A Mail Flow connector from the Exchange Admin Center has not been set properly to the FortiMail Cloud FQDN

Correct Answer: A and C

Explanation:

When troubleshooting issues with outgoing emails not being delivered to recipients, especially in the context of integrating FortiMail Cloud with Office 365, it's important to verify a few critical configurations. Let’s break down each option and its relevance to the issue:

• Option A: The FortiMail access control rule to relay from Office 365 servers FQDN is missing.
  In FortiMail, the access control rules are used to define which IPs or Fully Qualified Domain Names (FQDNs) are allowed to relay email. If the rule that specifically allows the Office 365 server FQDN to relay through FortiMail is missing, outgoing emails will be blocked or not properly routed. This configuration is crucial for allowing Office 365 servers to send emails through FortiMail. Therefore, this could be a possible reason for the issue where outgoing emails are not reaching the recipients' mail.

• Option B: The FortiMail DKIM key was not set using the Auto Generation option.
  While DKIM (DomainKeys Identified Mail) is important for email authentication and preventing spoofing, its absence or misconfiguration typically does not result in outgoing emails being blocked or not delivered entirely. Emails can still be delivered without DKIM as long as other configurations (such as SPF and access control rules) are correctly set up. Hence, this is less likely to be the primary cause of the problem.

• Option C: The FortiMail access control rules to relay from Office 365 servers public IPs are missing.
  Similar to the FQDN relay rule, the FortiMail device needs to have appropriate access control rules that allow the specific public IPs of Office 365 servers to relay emails. If these rules are missing or misconfigured, FortiMail may block the outgoing emails from Office 365. Therefore, this is a valid reason for the issue where outgoing emails are not reaching recipients.

• Option D: A Mail Flow connector from the Exchange Admin Center has not been set properly to the FortiMail Cloud FQDN.
  The Mail Flow connector in the Office 365 Exchange Admin Center is a critical component for routing emails through FortiMail. However, this setup typically concerns the incoming mail flow (i.e., directing inbound emails from FortiMail to Office 365) rather than outbound mail. If the connector isn't set up properly, it would more likely affect incoming mail rather than outgoing mail. Since the issue here involves outgoing emails, this is not the most likely cause of the problem.

In conclusion, Option A (missing access control rule for Office 365 FQDN) and Option C (missing access control rules for Office 365 servers' public IPs) are the two most probable causes for the issue, as they are directly related to the ability of Office 365 to relay outgoing emails through FortiMail. Therefore, the correct answers are A and C.

Question No 6:

FortiManager is configured with the Jinja Script under CLI Templates shown in the exhibit. Which two statements correctly describe the expected behavior when running this template? (Choose two.)

A. The Jinja template will automatically map the interface with “WAN” role on the managed FortiGate
B. The template will work if you change the variable format to $(WAN).
C. The template will work if you change the variable format to {{ WAN }}.
D. The administrator must first manually map the interface for each device with a meta field
E. The template will fail because this configuration can only be applied with a CLI or TCL script.

Answer: C, D

Explanation:

The Jinja template in FortiManager is a method to automate configuration tasks across multiple devices, and it leverages the Jinja templating language. Jinja uses {{ variable }} syntax to dynamically insert values during template processing.

Here’s the explanation for the correct answers:

• C. The template will work if you change the variable format to {{ WAN }}.
  This statement is correct because Jinja uses the {{ }} format for variables. So, if the template is written with {{ WAN }}, it will properly reference the variable WAN. The correct syntax for variables in Jinja templates is {{ variable_name }}.

• D. The administrator must first manually map the interface for each device with a meta field.
  This statement is correct. For FortiManager to apply a template involving specific interface roles (like WAN), the administrator typically needs to manually map the interfaces to the relevant meta fields for each device. This mapping is essential for ensuring that the template applies the correct settings to the correct interfaces.

Why the other options are incorrect:

• A. The Jinja template will automatically map the interface with “WAN” role on the managed FortiGate.
  This is incorrect because the Jinja template will not automatically map the interface with the "WAN" role unless the interfaces are explicitly mapped in the FortiManager configuration. The administrator must configure this mapping either manually or using meta fields as discussed in option D.

• B. The template will work if you change the variable format to $(WAN).
  This is incorrect because the $(WAN) format is not valid for Jinja templates. Jinja uses {{ variable_name }} for variables, not the $(variable_name) format. The $( ) syntax is typically used for shell scripts or similar scripting languages, but not in Jinja.

• E. The template will fail because this configuration can only be applied with a CLI or TCL script.
  This is incorrect. Jinja templates are specifically designed to be used in FortiManager’s CLI templates, which is a standard feature and doesn't require CLI or TCL scripts. The template will work if properly configured, and the issue is not related to using CLI or TCL scripts.

In conclusion, the correct answers are C and D, as they correctly describe the expected behavior of the template in FortiManager.

Question No 7:

SD-WAN is configured on a FortiGate. You notice that when one of the internet links has high latency, the time to resolve names using DNS from FortiGate is very high. You must ensure that the FortiGate DNS resolution times are as low as possible with the least amount of work. 

What should you configure?

A. Configure local out traffic to use the outgoing interface based on SD-WAN rules with a manual defined IP associated to a loopback interface and configure an SD-WAN rule from the loopback to the DNS server.
B. Configure an SD-WAN rule to the DNS server and use the FortiGate interface IPs in the source address.
C. Configure two DNS servers and use DNS servers recommended by the two internet providers.
D. Configure local out traffic to use the outgoing interface based on SD-WAN rules with the interface IP and configure an SD-WAN rule to the DNS server.

Answer: C

Explanation:

When dealing with high latency issues on an SD-WAN setup, it is essential to ensure that the FortiGate can resolve DNS queries quickly and efficiently. DNS resolution can be slow when the FortiGate relies on a single DNS server, especially when one of the internet links experiences high latency. To address this, the goal is to minimize DNS resolution time by ensuring that the FortiGate has multiple DNS servers to fall back on and can resolve names using the fastest possible connection.

Let's break down the correct answer:

C. Configure two DNS servers and use DNS servers recommended by the two internet providers.
The most straightforward and effective solution is to configure multiple DNS servers, ideally from both of the internet service providers used by the SD-WAN. By configuring two DNS servers from the different ISPs, the FortiGate can automatically use the DNS server that is reachable with the least latency. This allows for redundant and faster DNS resolution even if one internet link suffers from high latency. The FortiGate will switch to the other DNS server when the primary DNS server's link has high latency or becomes unavailable. This approach works without requiring extensive additional configuration and leverages the existing SD-WAN rules.

Now, let's review the other options:

A. Configure local out traffic to use the outgoing interface based on SD-WAN rules with a manual defined IP associated to a loopback interface and configure an SD-WAN rule from the loopback to the DNS server.
This option adds unnecessary complexity. It involves configuring a loopback interface and manual rules that are not directly related to improving DNS resolution times. This setup may not provide any significant improvement over simply using multiple DNS servers from different ISPs, and it is more cumbersome to configure.

B. Configure an SD-WAN rule to the DNS server and use the FortiGate interface IPs in the source address.
This solution could work by directing DNS traffic through a specific interface. However, this would require more specific configuration to optimize DNS resolution times, and it could lead to suboptimal routing if not carefully planned. It does not inherently address the problem of DNS resolution time being affected by latency on one link.

D. Configure local out traffic to use the outgoing interface based on SD-WAN rules with the interface IP and configure an SD-WAN rule to the DNS server.
This option is similar to B in that it involves creating an SD-WAN rule to ensure that DNS traffic uses a specific interface. However, it doesn't provide the same level of simplicity and redundancy as configuring multiple DNS servers. The need to control outgoing traffic and create custom rules can introduce unnecessary complexity.

In conclusion, the best solution with the least amount of work is C, which involves configuring two DNS servers recommended by the two internet providers. This ensures that the FortiGate has access to the fastest DNS server, improving resolution times and reliability.

Question No 8:

You have deployed a security fabric with three FortiGate devices as shown in the exhibit. FGT_2 has the following configuration: (image13) FGT_1 and FGT_3 are configured with the default setting. 

Which statement is true for the synchronization of fabric-objects?

A. Objects from the FortiGate FGT_2 will be synchronized to the upstream FortiGate
B. Objects from the root FortiGate will only be synchronized to FGT_2
C. Objects from the root FortiGate will not be synchronized to any downstream FortiGate
D. Objects from the root FortiGate will only be synchronized to FGT_3

Correct Answer: D

Explanation:

In a Fortinet Security Fabric setup, there is typically a root FortiGate device that serves as the central point for managing and synchronizing configuration data, including fabric objects such as addresses, address groups, and policies. The synchronization of fabric objects between FortiGate devices in the fabric depends on the role of each device in the fabric hierarchy.

Given the setup described:

• Root FortiGate: This is the FortiGate device that is responsible for managing the overall configuration and will push configuration updates to other FortiGate devices in the fabric. It synchronizes its settings with other FortiGates in the fabric.

• Upstream vs Downstream FortiGate Devices: In a typical Security Fabric topology, the root device synchronizes its configuration to downstream FortiGates (those that are positioned in a downstream role relative to the root). The synchronization does not occur upstream (from a downstream FortiGate to an upstream device).

Now, let’s break down each option:

• A. Objects from the FortiGate FGT_2 will be synchronized to the upstream FortiGate: This option is incorrect because synchronization of objects generally flows downstream from the root device, not upstream. Therefore, FGT_2 would not be synchronizing objects to an upstream device.

• B. Objects from the root FortiGate will only be synchronized to FGT_2: This option is incorrect because the root FortiGate device typically synchronizes to all downstream devices in the Security Fabric. In this case, it would synchronize to both FGT_2 and FGT_3, not just to FGT_2 alone.

• C. Objects from the root FortiGate will not be synchronized to any downstream FortiGate: This option is incorrect because, in a Security Fabric, the root FortiGate device is specifically responsible for synchronizing objects to downstream devices. Thus, the root FortiGate will synchronize its configuration to FGT_2 and FGT_3.

• D. Objects from the root FortiGate will only be synchronized to FGT_3: This is correct. If FGT_2 is configured with a special role (such as being a spoke or secondary device) that prevents it from receiving synchronization from the root FortiGate, then the root FortiGate would synchronize its objects to FGT_3 (the downstream FortiGate). This suggests that FGT_2 may have a specific role or configuration preventing it from receiving fabric object synchronization from the root FortiGate.

In conclusion, D is the correct answer because the root FortiGate device synchronizes its configuration primarily to downstream FortiGates, and in this case, FGT_3 would be the correct recipient of those synchronizations.