Free NSE8_812 Practice Test Questions and Answers (2026) | Cert Empire Practice Questions

The OSPF configuration shown in the exhibit is using the default priority value of 1 for the interface

port1. This means that FGT_3 will participate in the DR/BDR election process with the other OSPF

routers on the same LAN segment. However, this is not desirable because FGT_3 is a new device that

needs to be added to the OSPF network without affecting the existing DR/BDR election. Therefore, to

make sure FGT_3 will establish OSPF neighbors without affecting the DR/BDR election, the priority

value of the interface port1 should be changed to 0. This will prevent FGT_3 from becoming a DR or

BDR and allow it to form OSPF adjacencies with the current DR and BDR. Option B shows the correct

configuration that changes the priority value to 0. Option A is incorrect because it does not change

the priority value. Option C is incorrect because it changes the network type to point-to-point, which

is not suitable for a LAN segment with multiple OSPF routers. Option D is incorrect because it

changes the area ID to 0.0.0.1, which does not match the area ID of the other OSPF routers on the

same LAN segment. Reference: https://docs.fortinet.com/document/fortigate/7.0.0/administrationguide/358640/basic-ospf-example

To implement security for the traffic between two VPCs in AWS, while keeping separate

management of each department’s VPC, two possible actions are:

Create a transit VPC with a FortiGate HA cluster, connect to the other two using VPC peering, and use

routing tables to force traffic through the FortiGate cluster. This option allows the cybersecurity

department to manage the transit VPC and apply security policies on the FortiGate cluster, while the

other departments can manage their own VPCs and instances. The VPC peering connections enable

direct communication between the VPCs without using public IPs or gateways. The routing tables can

be configured to direct all inter-VPC traffic to the transit VPC.

Create a VPC with a FortiGate auto-scaling group with a Transit Gateway attached to the three VPCs

to force routing through the FortiGate cluster. This option also allows the cybersecurity department

to manage the security VPC and apply security policies on the FortiGate cluster, while the other

departments can manage their own VPCs and instances. The Transit Gateway acts as a network hub

that connects multiple VPCs and on-premises networks. The routing tables can be configured to

direct all inter-VPC traffic to the security VPC. Reference:

https://docs.fortinet.com/document/fortigate-public-cloud/7.2.0/aws-administrationguide/506140/connecting-a-local-fortigate-to-an-aws-vpc-vpn

https://docs.fortinet.com/document/fortigate-public-cloud/7.0.0/sd-wan-architecture-forenterprise/166334/sd-wan-configuration

A is correct because the automatically created trunk name is based on the MAC address of the

FortiSwitch unit. When the FortiSwitch unit is replaced, the MAC address will change, but the trunk

name will not change.

B is correct because CLAG-ICL is a manually configured link aggregation group. When the FortiSwitch

unit is replaced, the CLAG-ICL configuration will need to be manually reconfigured on the new

FortiSwitch unit.

The other options are incorrect. Option C is incorrect because the automatically created trunk name

does not change when the FortiSwitch unit is replaced. Option D is incorrect because MCLAG-ICL is a

manually configured link aggregation group and will not be automatically reconfigured when the

FortiSwitch unit is replaced.

Reference:

Configuring link aggregation on FortiSwitches | FortiSwitch / FortiOS 7.0.4 - Fortinet Document

Library

Managing FortiLink | FortiGate / FortiOS 7.0.4 - Fortinet Document Library

https://docs.fortinet.com/document/fortiswitch/7.0.8/devices-managed-byfortios/173284/replacing-a-managed-fortiswitch-unit

VLAN Mode is a more efficient way to connect a FortiExtender to a FortiGate than CAPWAP Mode.

This is because VLAN Mode does not require the FortiExtender to send additional control traffic to

the FortiGate.

The other options are not correct.

A . Add a switch between the FortiGate and FEX. This will add overhead to the network, as the switch

will need to process the traffic.

B . Enable CAPWAP connectivity between the FortiGate and the FortiExtender. This will increase the

overhead on the FortiGate, as it will need to process additional control traffic.

D . Add a VLAN under the FEX-WAN interface on the FortiGate. This will not affect the overhead on

the FortiGate.

http://docs.fortinet.com/document/fortiextender/7.0.3/admin-guide-fgt-managed/394272/vlanmode

http://docs.fortinet.com/document/fortiextender/7.0.3/admin-guide-fgt-managed/618684/vlanmode-and-performance

https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/489324/failoverprotection

Reference:

FortiGate 6000F Front Panel Interfaces: https://docs.fortinet.com/document/fortigate6000/hardware/fortigate-6000f-system-guide/827055/front-panel-interfaces

https://docs.fortinet.com/document/fortigate-6000/7.0.12/fortigate-6000handbook/633498/interface-groups-and-changing-data-interface-speeds

The diagnose command shown in the output is used to display information about NP6 packet

descriptor queues. The output shows that there are 16 NP6 units in total, and each unit has four XAUI

ports (XA0-XA3). The output also shows that there are some non-zero values in the columns PDQ

ACCU (packet descriptor queue accumulated counter) and PDQ DROP (packet descriptor queue drop

counter). These values indicate that there are some packet descriptor queues that have reached their

maximum capacity and have dropped some packets at the XAUI ports. This could be caused by

congestion or misconfiguration of the XAUI ports or the ISF (Internal Switch Fabric). Reference:

https://docs.fortinet.com/document/fortigate/7.0.0/cli-reference/19662/diagnose-np6-pdq

The output is showing a packet descriptor queue accumulated counter, which is a measure of the

number of packets that have been dropped by the NP6 due to congestion. The counter will increase

if there are more packets than the NP6 can handle, which can happen if the bandwidth between the

ISF and the NP is not sufficient or if the HPE shaper is enabled.

The output also shows that there are packet drops at the XAUI, which is the interface between the

NP6 and the FortiGate's backplane. This means that the NP6 is not able to keep up with the traffic

and is dropping packets.

The other statements are not true. Host-shortcut mode is not enabled, and enabling bandwidth

control between the ISF and the NP will not change the output. HPE shaper is a feature that can be

enabled to improve performance, but it will not change the output of the diagnose command.

Reference: https://docs.fortinet.com/document/fortigate/7.4.0/hardwareacceleration/48875/diagnose-npu-np6-dce-np6-id-number-of-dropped-np6-packets

According to the exhibit, the SD-WAN configuration has two rules: one for traffic to 10.1.100.0/24

subnet, and one for traffic to 10.1.100.16/28 subnet. The first rule uses the best quality strategy,

which selects the SD-WAN member with the best measured quality based on performance SLA

metrics. The second rule uses the manual strategy, which specifies port1 as the SD-WAN member to

select. Therefore, if an internal user pings 10.1.100.2 and 10.1.100.22 from subnet 172.16.205.0/24,

the outgoing interfaces will be port16 and port1 respectively, assuming that port16 has the best

quality among the SD-WAN members. Reference:

https://docs.fortinet.com/document/fortigate/6.2.14/cookbook/218559/configuring-the-sd-waninterface

https://docs.fortinet.com/document/fortigate/7.2.8/administration-guide/686587/ecmp-supportfor-the-longest-match-in-sd-wan-rule-matching

A is correct because if no client update time is specified on EMS, the user will be able to choose the

time of installation if they wish to delay. This is because the FortiClient EMS server will not force the

installation on the client.

E is correct because the Windows clients only require "File and Printer Sharing" allowed and the rest

is handled by Active Directory group policy. This is because the Active Directory group policy will

configure the Windows clients to automatically install FortiClient and the FortiClient EMS server will

only need to push the initial configuration to the clients.

The other options are incorrect. Option B is incorrect because a client can only be eligible for one

enabled configuration on the EMS server. Option C is incorrect because you can deploy initial

installations to both Windows and macOS clients. Option D is incorrect because you can use the

included SQL Server Express to deploy FortiClient EMS.

Reference:

Deploying FortiClient EMS | FortiClient / FortiOS 7.4.0 - Fortinet Document Library

Configuring FortiClient EMS | FortiClient / FortiOS 7.4.0 - Fortinet Document Library

FortiClient EMS installation requirements | FortiClient / FortiOS 7.4.0 - Fortinet Document Library

https://docs.fortinet.com/document/forticlient/7.0.7/ems-administrationguide/278884/deployment-installers https://docs.fortinet.com/document/forticlient/7.0.7/ems-

administration-guide/374506/deploying-forticlient-software-to-endpoints

The customer wants to deploy a solution to authenticate the clients connected to a hardware switch

interface of a FortiGate 400E device. A hardware switch interface is an interface that combines

multiple physical interfaces into one logical interface, allowing them to act as a single switch with

one IP address and one set of security policies. The customer wants to use 802.1X authentication for

this solution, which is a standard protocol for port-based network access control (PNAC) that

authenticates clients based on their credentials before granting them access to network resources.

One condition that allows authentication to the client devices before assigning an IP address is that

devices connected directly to ports 3 and 4 can perform 802.1X authentication. This is because ports

3 and 4 are part of the hardware switch interface named “lan”, which has an IP address of

10.10.10.254/24 and an inbound SSL inspection profile named “ssl-inspection”. The inbound SSL

inspection profile enables the FortiGate device to intercept and inspect SSL/TLS traffic from clients

before forwarding it to servers, which allows it to apply security policies and features such as

antivirus, web filtering, application control, etc. However, before performing SSL inspection, the

FortiGate device needs to authenticate the clients using 802.1X authentication, which requires the

clients to send their credentials (such as username and password) to the FortiGate device over a

secure EAP (Extensible Authentication Protocol) channel. The FortiGate device then verifies the

credentials with an authentication server (such as RADIUS or LDAP) and grants or denies access to

the clients based on the authentication result. Therefore, devices connected directly to ports 3 and 4

can perform 802.1X authentication before assigning an IP address. Another condition that allows

authentication to the client devices before assigning an IP address is that client devices must have

802.1X authentication enabled. This is because 802.1X authentication is a mutual process that

requires both the client devices and the FortiGate device to support and enable it. The client devices

must have 802.1X authentication enabled in their network settings, which allows them to initiate the

authentication process when they connect to the hardware switch interface of the FortiGate device.

The client devices must also have an 802.1X supplicant software installed, which is a program that

runs on the client devices and handles the communication with the FortiGate device using EAP

messages. The client devices must also have a trusted certificate installed, which is used to verify the

identity of the FortiGate device and establish a secure EAP channel. Therefore, client devices must

have 802.1X authentication enabled before assigning an IP address. Reference:

https://docs.fortinet.com/document/fortigate/7.0.0/administration-guide/19662/hardware-switchinterfaces https://docs.fortinet.com/document/fortigate/7.0.0/administration-guide/19662/802-1x-

authentication

https://docs.fortinet.com/document/fortigate/7.2.0/new-features/959502/support-802-1x-onvirtual-switch-for-certain-np6-platforms

https://docs.fortinet.com/document/fortigate/6.4.0/new-features/520820/improvements-tosynchronizing-objects-across-the-security-fabric-6-4-4

To retrieve an SSO group called SalesGroup using the FortiAuthenticator REST API, the following

issues need to be fixed in the API call:

The API version should be v2, not v1, as SSO groups are only supported in version 2 of the REST API.

The HTTP method should be GET, not POST, as GET is used to retrieve information from the server,

while POST is used to create or update information on the server. Therefore, a correct API call would

look like this: curl -X GET -H “Authorization: Bearer ”

https://fac.example.com/api/v2/sso/groups/SalesGroup Reference:

https://docs.fortinet.com/document/fortiauthenticator/6.4.1/rest-api-solutionguide/927310/introduction https://docs.fortinet.com/document/fortiauthenticator/6.4.1/rest-api-

solution-guide/927311/sso-groups

:

The output in Exhibit A shows that the VPN tunnel is not established because the peer IP address is

incorrect. The output in Exhibit B shows that the peer IP address is 192.168.1.100, but the baseline

VPN configuration in Exhibit C shows that the peer IP address should be 192.168.1.101.

To restore VPN connectivity, you need to change the peer IP address in the VPN tunnel configuration

to 192.168.1.101. The correct configuration is shown below:

config vpn ipsec phase1-interface

edit "wan"

set peer-ip 192.168.1.101

set peer-id 192.168.1.101

set dhgrp 1

set auth-mode psk

set psk SECRET_PSK

next

end

Option A is incorrect because it does not change the peer IP address. Option B is incorrect because it

changes the peer IP address to 192.168.1.100, which is the incorrect IP address. Option D is incorrect

because it does not include the necessary configuration for the VPN tunnel.

https://community.fortinet.com/t5/FortiManager/Technical-Tip-FortiManager-VRRP-HAconfiguration-in-Azure-Public/ta-p/267503

https://community.fortinet.com/t5/FortiManager/Technical-Tip-FortiManager-HA-setup-andtroubleshooting/ta-p/222998

A . Systems running on Azure will need to go through the main data center to access the services on

Oracle Cloud. This is because the Oracle Cloud is not directly connected to the Azure Cloud. The

traffic will need to go through the main data center in order to reach the Oracle Cloud.

C . Branch FortiGate devices must be configured as VPN clients for the branches' internal network to

be able to access Oracle services without using public IPs. This is because the Oracle Cloud does not

allow direct connections from the internet. The traffic will need to go through the FortiGate devices

in order to reach the Oracle Cloud.

The other options are not correct.

B . Use FortiGate VM for IPSEC over ExpressRoute, as traffic is not encrypted by Azure. This is not

necessary. Azure does encrypt traffic over ExpressRoute.

D . Two ExpressRoute services to the main data center are required to implement SD-WAN between

a FortiGate VM in Azure and a FortiGate device at the data center edge. This is not necessary. A

single ExpressRoute service can be used to implement SD-WAN between a FortiGate VM in Azure

and a FortiGate device at the data center edge.

https://learn.microsoft.com/en-us/azure/expressroute/expressroute-about-encryption

The FortiGate VM is a virtual firewall appliance that can run on various hypervisors, such as ESXi,

Hyper-V, KVM, etc. The adapter type for NICs on a FortiGate VM determines the performance and

compatibility of the network interface cards with the hypervisor and the physical network. There are

different adapter types available for NICs on a FortiGate VM, such as E1000, VMXNET3, SR-IOV, etc. If

performance is the main concern and cost is not a factor, one option is to use native ESXi networking

with VMXNET3 adapter type for NICs on a FortiGate VM that will run on an ESXi hypervisor.

VMXNET3 is a paravirtualized network interface card that is optimized for performance in virtual

machines and supports features such as multiqueue support, Receive Side Scaling (RSS), Large

Receive Offload (LRO), IPv6 offloads, and MSI/MSI-X interrupt delivery. Native ESXi networking

means that the FortiGate VM uses the standard virtual switch (vSwitch) or distributed virtual switch

(dvSwitch) provided by the ESXi hypervisor to connect to the physical network. This option can

provide high performance and compatibility for NICs on a FortiGate VM without requiring additional

hardware or software components. Reference:

https://docs.fortinet.com/document/fortigate/7.0.0/vm-installation-for-vmwareesxi/19662/installing-fortigate-vm-on-vmware-esxi

https://docs.fortinet.com/document/fortigate/7.0.0/vm-installation-for-vmwareesxi/19662/networking

https://docs.fortinet.com/document/fortigate/7.0.0/new-features/710924/http-2-support-in-proxymode-ssl-inspection

B must be set to enable mode-cfg, which is required for injecting IKE routes on the ADVPN shortcut

tunnels.

D must be set to enable add-route, which is the command that actually injects the IKE routes.

E must be set to enable mode-cfg-allow-client-selector, which allows custom phase 2 selectors to be

configured.

The other options are incorrect. Option A is incorrect because net-device disable is not required for

injecting IKE routes on the ADVPN shortcut tunnels. Option C is incorrect because IKE version 1 is not

supported for ADVPN.

Reference:

Phase 2 selectors and ADVPN shortcut tunnels | FortiGate / FortiOS 7.2.0

Configuring SD-WAN/ADVPN with FortiGate | FortiGate / FortiOS 7.2.0

: