NSE8 sample questions

Question 1

A security engineer has created an automation stitch to block suspicious source IPs that trigger a specific IPS signature. The stitch is configured with a trigger for 'IPS Signature' and an action to add the source IP to an address group used in a deny policy. However, the stitch is not working as expected. During troubleshooting, the engineer observes that the trigger event is generated correctly in the logs. Which TWO of the following configuration issues could be the cause of the failure? (Select TWO).

Accepted Answer

The address group being modified by the stitch is not set to 'Dynamic' type.

Accepted Answer

The REST API access is disabled on the interface where the automation stitch is processed, typically the internal management interface.

Answer

The automation stitch action requires an administrator profile with read-only privileges.

Answer

The IPS sensor logging is disabled for the signature that should activate the trigger.

Question 2

True or False: When configuring BGP route redistribution into OSPF on a FortiGate, the `redistribute bgp` command under `router ospf` is sufficient to advertise BGP routes to OSPF neighbors without any additional route maps or filters.

Accepted Answer

True

Answer

False

Question 3

A systems administrator is configuring a FortiGate to act as a SAML Service Provider (SP) for administrative access. The Identity Provider (IdP) is a third-party service. After configuring the SAML settings, authentication fails. The SAML debug output indicates a `SubjectNotOnOrAfter` error. What is the most likely cause of this issue?

Accepted Answer

There is a significant time skew between the FortiGate's system clock and the IdP's server clock.

Answer

The SP certificate on the FortiGate has expired.

Answer

The IdP entity ID configured on the FortiGate does not match the IdP's metadata.

Answer

The user's group attribute is not being sent in the SAML assertion.

Question 4

An organization uses FortiClient EMS to manage endpoints and enforce compliance. The security team wants to implement a Zero Trust Network Access (ZTNA) policy where only endpoints with an active FortiClient, a specific software version installed, and a high security posture tag can access internal applications. Which component is responsible for collecting the endpoint posture information and assigning the relevant ZTNA tags?

Accepted Answer

FortiClient EMS.

Answer

The FortiGate ZTNA proxy.

Answer

The FortiAnalyzer Fabric SOC.

Answer

The FortiAuthenticator server.

Question 5

A large enterprise has deployed FortiGate 7000 series chassis in their data centers. A network architect needs to explain the data path for traffic that can be fully offloaded by the NP7 processors. Which option correctly describes the 'fast path' for a TCP session through the chassis?

Accepted Answer

Ingress FIM -> Fabric Backplane -> FPM (NP7) -> Fabric Backplane -> Egress FIM

Answer

Ingress FIM -> Fabric Backplane -> FortiGate CPU -> Fabric Backplane -> Egress FIM

Answer

Ingress FIM -> Fabric Backplane -> FPM (NP7) -> FPM (CP9) -> Fabric Backplane -> Egress FIM

Answer

Ingress FIM -> FortiGate CPU -> Egress FIM

Question 6

An engineer is using the FortiGate REST API to automate the creation of firewall address objects. The following Python code snippet is used to send the request. Assuming the API key and FortiGate IP are correct, what must be added to the request headers for it to be accepted by the FortiGate?

```python
import requests

api_key = 'your_api_key'
fg_ip = '10.0.1.1'

headers = {
'Authorization': f'Bearer {api_key}',
# Missing header here
}

url = f'https://{fg_ip}/api/v2/cmdb/firewall/address'

response = requests.post(url, headers=headers, verify=False)
```

Accepted Answer

'Content-Type': 'application/json'

Answer

'Accept': 'application/xml'

Answer

'X-Forwarded-For': '127.0.0.1'

Answer

'User-Agent': 'Python-Requests'

Question 7

A global enterprise has a complex hub-and-spoke ADVPN deployment. They are experiencing issues where spoke-to-spoke shortcut tunnels are not forming for VoIP traffic, causing calls to hairpin through the hub and increasing latency. The IPsec, BGP, and underlying network connectivity have been verified as correct. What is a common ADVPN-specific reason for this behavior?

Accepted Answer

The firewall policy on the hub that allows spoke-to-spoke traffic is missing the `set auto-discovery-shortcut enable` command.

Answer

The `auto-discovery-sender` is enabled on the hub but disabled on the spokes.

Answer

The spokes are using IKEv1 instead of IKEv2 in their Phase 1 configuration.

Answer

The firewall policy on the hub that allows spoke-to-spoke traffic does not have `auto-asic-offload` disabled.

Question 8

A consultant is reviewing an SD-WAN deployment where application performance is poor despite having two high-quality internet links. The configuration uses a performance SLA with latency, jitter, and packet loss thresholds. The SD-WAN rule is set to 'Best Quality'. The consultant observes from the performance SLA logs that both links are consistently marked as 'dead' (red), even though manual ping tests show low latency and no loss. What is the most likely configuration error?

Accepted Answer

The health-check server is unreachable from the FortiGate's WAN interfaces.

Answer

The SD-WAN rule is using an incorrect outgoing interface.

Answer

The latency and jitter thresholds are set to 0 in the performance SLA.

Answer

Implicit SD-WAN rules are taking precedence over the configured rule.

Question 9

A company is implementing a multi-VDOM architecture on a single FortiGate. The goal is to have a dedicated VDOM for managing internet-facing services (INET-VDOM) and another for internal corporate services (CORP-VDOM). An inter-VDOM link connects them. An administrator in CORP-VDOM needs to access a server in INET-VDOM. Which two components are essential for enabling this traffic flow? (Select TWO).
```mermaid
graph TD
subgraph FortiGate
subgraph CORP_VDOM
AdminPC[Admin PC]
VDOM_Link_C[port: vlink_corp]
end
subgraph INET_VDOM
WebServer[Web Server]
VDOM_Link_I[port: vlink_inet]
end
VDOM_Link_C -- Inter-VDOM Link -- VDOM_Link_I
end
AdminPC --> VDOM_Link_C
VDOM_Link_I --> WebServer
```

Accepted Answer

A static route in CORP-VDOM pointing to INET-VDOM's network via the inter-VDOM link.

Accepted Answer

A firewall policy in INET-VDOM allowing traffic from the inter-VDOM link to the server.

Answer

A single firewall policy in the global VDOM to allow inter-VDOM traffic.

Answer

A virtual wire pair policy applied to the inter-VDOM link.

Answer

Enabling `allow-inter-vdom-traffic` under `config system global`.

Question 10

During a security audit, it was discovered that an automated script is adding hundreds of temporary IP addresses to a dynamic firewall address group via the API. This is causing high CPU utilization on the FortiGate. The security architect decides to implement a solution using the FortiManager CLI to prevent this. Which FortiManager feature allows an administrator to define a script that runs automatically when configuration changes are imported from a device, which can be used to validate and reject the unwanted changes?

Accepted Answer

TCL script assigned as a verification script

Answer

Device Blueprint

Answer

Policy Package Workflow

Answer

CLI Template with variables

Free NSE8 sample questions

True or False: When configuring BGP route redistribution into OSPF on a FortiGate, the `redistribute bgp` command under `router ospf` is sufficient to advertise BGP routes to OSPF neighbors without any additional route maps or filters.

A large enterprise has deployed FortiGate 7000 series chassis in their data centers. A network architect needs to explain the data path for traffic that can be fully offloaded by the NP7 processors. Which option correctly describes the 'fast path' for a TCP session through the chassis?

10 more free samples are waiting