Some candidates like to print, others prefer software, and many study on a phone. That is why Fast2test offers the NSE8_813 practice questions as a printable PDF, a desktop test engine that simulates the real exam environment, and an online test engine that runs in any browser — pick whichever fits the way you prepare for the Fortinet NSE 8 - Recertification.

Fortinet NSE8_813 Exam Overview:

Fortinet NSE8_813 Exam Syllabus Topics:

NSE8_813 Exam FAQ: What Candidates Ask About Fortinet NSE 8 - Recertification

Fortinet NSE 8 - Recertification Sample Questions:

Question 1

A FortiGate is used as a VPN hub for a number of remote spoke VPN units (Group A) spokes using a phase 1 main mode dial-up tunnel and pre-shared keys. You are asked to establish VPN connectivity for a newly acquired organization's sites for which new devices will be provisioned Group B spokes.
Both existing Group A and new Group B spoke units are dynamically addressed through a single public IP Address on the hub. You are asked to ensure that spokes from Group B have different access permissions than the existing VPN spokes units Group A.
Which two solutions meet the requirements for the new spoke group? (Choose two.)

A. Implement a new phase 1 dial-up main mode tunnel with certificate authentication.
B. Implement a new phase 1 dial-up main mode tunnel with pre-shared keys and XAuth.
C. Implement a new phase 1 dial-up main mode tunnel with a different pre-shared key than the Group A spokes.
D. Implement separate phase 1 dial-up aggressive mode tunnels with a distinct peer ID.

Question 2

A static route is configured for a FortiGate unit from the CLI using the following commands:
config router static
edit 1
set device "wan1"
set distance 20
set gateway 192.168.100.1
next
end
Which of the following conditions is NOT required for this static default route to be displayed in the FortiGate unit's routing table?

A. The Link Status of the wan1 interface is displayed as Up.
B. The Administrative Status of the wan1 interface is displayed as Up.
C. All other default routes should have an equal or higher distance.
D. You must disable DHCP client on that interface.

Question 3

Review the following FortiGate-6000 configuration excerpt:

Based on the configuration, which statement is correct regarding SNAT source port partitioning behavior?

A. It equally distributes SNAT source ports across chassis slots.
B. It statically distributes SNAT source ports to operating FPCs or FPMs.
C. It dynamically distributes SNAT source ports to operating FPCs or FPMs.
D. It is the default SNAT configuration and preserves active sessions when an FPC or FPM goes down.

Question 4

There is an interface-mode IPsec tunnel configured between FortiGate1 and FortiGate2.
You want to run OSPF over the IPsec tunnel. On both FortiGates. the IPsec tunnel is based on physical interface Port1. Port1 has the default MTU setting on both FortiGate units.
Which statement is true about this scenario?

A. An IP address must be assigned to the IPsec interface on FortiGate1 and FortiGate2.
B. A multicast firewall policy must be added on FortiGate1 and FortiGate2 to allow protocol 89.
C. The MTU must be set manually in the OSPF interface configuration.
D. The MTU must be set manually on the IPsec interface.

Question 5

Your security department has requested that you implement the OpenSSL TLS Heartbeat lnformation disclosure signature using an IPS sensor to scan traffic destined to the FortiGate.
You must log all packets that attempt to exploit this vulnerability.
Referring to the exhibit, which two configurations are required to accomplish this task? (Choose two.)

A.

B.

C.

D.

Solutions: