NSE8_812 Network Security Expert 8 Written Exam Questions and Answers

B is correct because creating an HA setup with a second FortiDDoS 200F will provide redundancy in case one of the devices fails. This will prevent all traffic from being dropped in the event of a failure.

D is correct because the FortiDDoS 1500F has a larger throughput capacity than the FortiDDoS 200F. This means that it will be less likely to drop traffic even under heavy load.

The other options are incorrect. Option A is incorrect because changing the Adaptive Mode will not prevent the device from dropping traffic. Option C is incorrect because moving the internet connection from the SFP interfaces to the LC interfaces will not change the throughput capacity of the device.

References:

FortiDDoS 200F Datasheet | Fortinet Document Library

FortiDDoS 1500F Datasheet | Fortinet Document Library

High Availability (HA) on FortiDDoS | FortiDDoS / FortiOS 7.0.0 - Fortinet Document Library

C. The IP address of the FortiSwitch is 10.12.240.2:This statement is correct based on the exhibit and your clarification. The exhibit lists the "IP Address" as 10.12.240.2 across multiple entries, including ports and VLANs associated with the device "sup-fgt-hw" (FortiSwitch). Your reasoning indicates that this IP is the management address of the FortiSwitch, as it is consistently shown as the IP for the device containing the ports. In Fortinet’s architecture, as described in the NSE 8 study guide, the management IP of a FortiSwitch is typically configured and visible in such configurations, especially when integrated with FortiGate and FortiNAC. The "Device" column labeling "sup-fgt-hw" further supports that this is the FortiSwitch, and the IP 10.12.240.2 is its management address. This aligns with FortiSwitch management and integration details in the NSE 8 study guide.

D. An unknown host is connected to port3:This statement is correct as the exhibit highlights port3 under the "Name" column for the device "sup-fgt-hw" with a "Rogue Host" status in the "Connection" column, an IP address of 10.12.240.2, a Default VLAN of 100, and an Operational Status of "Link Up." In FortiNAC, a "Rogue Host" indicates an unknown or unauthorized device connected to the network, which FortiNAC identifies for further action or isolation. This is consistent with FortiNAC’s capabilities for detecting and classifying unknown devices, as detailed in the NSE 8 study guide under network access control and rogue device detection.

Why A and B are incorrect:

A. A device that is modeled in FortiNAC is connected on VLAN_4093: This is incorrect based on your clarification that there is no device connected on that port—it is simply the default VLAN (4093) for that entry. The exhibit shows VLAN_4093 with a "Not Connected" status and "Link Up" operational status, but no active device connection is indicated. The NSE 8 study guide emphasizes that FortiNAC requires an active connection and device profiling for a device to be considered "connected," which is not evident here for VLAN_4093.

B. Port8 is connected to a FortiGate in FortiLink mode: This is incorrect because the exhibit shows port8 with a "Learned Uplink" status, which, as you noted, refers to any kind of uplink and does not specifically indicate FortiLink mode. FortiLink mode is a specific configuration between FortiGate and FortiSwitch requiring explicit settings, which are not mentioned or implied in the exhibit. The NSE 8 study guide clarifies that FortiLink mode involves distinct configuration details (e.g., FortiLink interfaces), which are absent here.

Fortinet Network Security Expert 8 Study Guide References:

FortiNAC 7.2 Admin Guide (NSE 8): Sections on Device Visibility, VLAN Management, and Rogue Device Detection.

FortiSwitch 7.2 Admin Guide (NSE 8): Sections on FortiLink Configuration, Network Segmentation, and Management IP Configuration.

FortiGate 7.2 Admin Guide (NSE 8): Sections on Integration with FortiNAC and FortiSwitch for Network Security.

The output in Exhibit A shows that the VPN tunnel is not established because the peer IP address is incorrect. The output in Exhibit B shows that the peer IP address is 192.168.1.100, but the baseline VPN configuration in Exhibit C shows that the peer IP address should be 192.168.1.101.

To restore VPN connectivity, you need to change the peer IP address in the VPN tunnel configuration to 192.168.1.101. The correct configuration is shown below:

config vpn ipsec phase1-interface

edit "wan"

set peer-ip 192.168.1.101

set peer-id 192.168.1.101

set dhgrp 1

set auth-mode psk

set psk SECRET_PSK

next

end

Option A is incorrect because it does not change the peer IP address. Option B is incorrect because it changes the peer IP address to 192.168.1.100, which is the incorrect IP address. Option D is incorrect because it does not include the necessary configuration for the VPN tunnel.

The default load balancing mode for the SD-WAN implicit rule is source IP based. This means that traffic will be load balanced evenly between the overlay members, regardless of the member's priority.

To prevent traffic from being load balanced, you can configure the priority of each overlay member to 10. This will make the member ineligible for load balancing.

The other options are not correct. Changing the load balancing mode to source-IP based will still result in traffic being load balanced. Creating a new static route with the internet sdwan-zone only will not affect the load balancing of the overlay interface. Configuring the cost in each overlay member to 10 will also not affect the load balancing, as the cost is only used when the implicit rule cannot find a match for the destination IP address.

https://docs.fortinet.com/document/fortigate/6.4.0/sd-wan-deployment-for-mssps/775385/defining-interface-members

According to the exhibit, the SD-WAN configuration has two rules: one for traffic to 10.1.100.0/24 subnet, and one for traffic to 10.1.100.16/28 subnet. The first rule uses the best quality strategy, which selects the SD-WAN member with the best measured quality based on performance SLA metrics. The second rule uses the manual strategy, which specifies port1 as the SD-WAN member to select. Therefore, if an internal user pings 10.1.100.2 and 10.1.100.22 from subnet 172.16.205.0/24, the outgoing interfaces will be port16 and port1 respectively, assuming that port16 has the best quality among the SD-WAN members. References:https://docs.fortinet.com/document/fortigate/6.2.14/cookbook/218559/configuring-the-sd-wan-interface

https://docs.fortinet.com/document/fortigate/7.2.8/administration-guide/686587/ecmp-support-for-the-longest-match-in-sd-wan-rule-matching

https://docs.fortinet.com/document/fortimanager/7.4.2/administration-guide/30332/verifying-devices-with-private-data-encryption-enabled

The MTA adapter feature on FortiSandbox is a feature that allows FortiSandbox to act as a mail transfer agent (MTA) that can receive, inspect, and forward email messages from external sources. The MTA adapter feature can be used to integrate FortiSandbox with third-party email security solutions that do not support direct integration with FortiSandbox, such as Microsoft Exchange Server or Cisco Email Security Appliance (ESA). The MTA adapter feature can also be used to enhance email security by adding an additional layer of inspection and filtering before delivering email messages to the final destination. The MTA adapter feature can be enabled on FortiSandbox in an HA-Cluster, which is a configuration that allows two FortiSandbox units to synchronize their settings and data and provide high availability and load balancing for sandboxing services. However, one statement about this solution that is true is that the MTA adapter is only available in the primary node. This means that only one FortiSandbox unit in the HA-Cluster can act as an MTA and receive email messages from external sources, while the other unit acts as a backup node that can take over the MTA role if the primary node fails or loses connectivity. This also means that only one IP address or FQDN can be used to configure the external sources to send email messages to the FortiSandbox MTA, which is the IP address or FQDN of the primary node. References: https://docs.fortinet.com/document/fortisandbox/3.2.0/administration-guide/19662/mail-transfer-agent-mta https://docs.fortinet.com/document/fortisandbox/3.2.0/administration-guide/19662/high-availability-ha

https://docs.fortinet.com/document/fortisandbox/4.4.3/administration-guide/877925/mta-adapter

When multicast-skip-policy is enabled, no check is performed based on multicast policy. A multicast packet received on an interface is flooded unconditionally to all interfaces (except the incoming interface) belonging to the same forwarding domain. Multicast packets are forwarded even when there is no multicast policy or the multicast policy is set to deny. To forward multicast traffic based on multicast policy, multicast-skip-policy must be disabled. In transparent mode, there is a per-VDOM configuration to skip policy check and forward all multicast traffic. This command is only available in transparent mode, and is disabled by default.

References:

Configuring SSL VPN authentication using digital certificates | FortiGate / FortiOS 7.2.0 - Fortinet Document Library

Online Certificate Status Protocol (OCSP) | FortiGate / FortiOS 7.2.0 - Fortinet Document Library

Certificate Revocation Lists (CRLs) | FortiGate / FortiOS 7.2.0 - Fortinet Document Library

To implement security for the traffic between two VPCs in AWS, while keeping separate management of each department’s VPC, two possible actions are:

Create a transit VPC with a FortiGate HA cluster, connect to the other two using VPC peering, and use routing tables to force traffic through the FortiGate cluster. This option allows the cybersecurity department to manage the transit VPC and apply security policies on the FortiGate cluster, while the other departments can manage their own VPCs and instances. The VPC peering connections enable direct communication between the VPCs without using public IPs or gateways. The routing tables can be configured to direct all inter-VPC traffic to the transit VPC.

Create a VPC with a FortiGate auto-scaling group with a Transit Gateway attached to the three VPCs to force routing through the FortiGate cluster. This option also allows the cybersecurity department to manage the security VPC and apply security policies on the FortiGate cluster, while the other departments can manage their own VPCs and instances. The Transit Gateway acts as a network hub that connects multiple VPCs and on-premises networks. The routing tables can be configured to direct all inter-VPC traffic to the security VPC. References: https://docs.fortinet.com/document/fortigate-public-cloud/7.2.0/aws-administration-guide/506140/connecting-a-local-fortigate-to-an-aws-vpc-vpn https://docs.fortinet.com/document/fortigate-public-cloud/7.0.0/sd-wan-architecture-for-enterprise/166334/sd-wan-configuration

https://help.fortinet.com/fddos/4-3-0/FortiDDoS/Built_in_bypass.htm

https://docs.fortinet.com/document/fortiswitch/7.0.8/devices-managed-by-fortios/801194/deploying-mclag-topologies

D. The administrator must first manually map the interface for each device with a meta field.

The Jinja template in the exhibit is expecting a meta field calledWANto be set on the managed FortiGate. This meta field will specify which interface on the FortiGate should be assigned the "WAN" role. If the meta field is not set, then the template will fail.

E. The template will fail because this configuration can only be applied with a CLI or TCL script.

The Jinja template in the exhibit is trying to configure the interface role on the managed FortiGate. This type of configuration can only be applied with a CLI or TCL script. The Jinja template will fail because it is not a valid CLI or TCL script.

To enable application detection on plain-text traffic that has been decrypted by FortiADC, the administrator must perform two configuration tasks on CL-1:

Enable SSL offloading in the firewall policy and select the SSL-Offload protocol options profile.

Enable application control in the firewall policy and select the SSL-Offload-App-Detect application list. References: https://docs.fortinet.com/document/fortigate/6.4.0/cookbook/103438/application-detection-on-ssl-offloaded-traffic

https://community.fortinet.com/t5/FortiAnalyzer/Technical-Note-Understanding-FortiAnalyzer-time-related-fields/ta-p/197569

Impersonation analysis is a feature that detects emails that attempt to impersonate a trusted sender, such as a company executive or a well-known brand, by using spoofed or look-alike email addresses. This feature can help prevent phishing and business email compromise (BEC) attacks. Impersonation analysis can be enabled in an antispam profile and applied to a firewall policy. References:https://docs.fortinet.com/document/fortimail/6.4.0/administration-guide/103663/impersonation-analysis

https://docs.fortinet.com/document/fortimail/7.2.0/cookbook/221814/protecting-against-email-impersonation-in-fortimail