Fortinet NSE8_813 : Fortinet NSE 8 - Recertification Exam

A customer has the following requirements:
- local peer with two Internet links
- remote peer with one Internet link
- secure traffic between the two peers
- granular control with Accept policies
Which solution provides security and redundancy for traffic between the two peers?

• A. a fully redundant VPN with tunnel mode configuration
• B. a partially redundant VPN with tunnel mode configuration
• C. a fully redundant VPN with interface mode configuration
• D. a partially redundant VPN with interface mode configuration

FortiGatel has a gateway-to-gateway IPsec VPN to FortiGate2. The entire IKE negotiation between FortiGatel and FortiGate2 is on UDP port 500. A PC on FortuGate2's local area network is sending continuous ping requests over the VPN tunnel to a PC of FortiGatel's local area network. No other traffic is sent over the tunnel.
Which statement is true on this scenario?

• A. FortiGatel sends an R-U-THERE packet if pings stop for 60 seconds and no IKE packet is received during this period.
• B. FortiGatel sends an R-U-TH ERE packet every 300 seconds while ping traffic is flowing.
• C. FortiGatel sends an R-U-TH ERE packet if pings stop for 300 seconds and no IKE packet is received during this period.
• D. FortiGatel sends an R-U-TH ERE packet every 60 seconds while ping traffic is flowing.

Refer to the exhibit. You are deploying a FortiGate 6000F. The device should be directly connected to a switch. In the future, a new hardware module providing higher speed will be installed in the switch, and the connection to the FortiGate must be moved to this higher-speed port.
You must ensure that the initial FortiGate interface connected to the switch does not affect any other port when the new module is installed and the new port speed is defined.
How should the initial connection be made?

• A. Connect the switch on any interface between ports 21 to 24
• B. Connect the switch on any interface between ports 1 to 4
• C. Connect the switch on any interface between ports 5 to 8
• D. Connect the switch on any interface between ports 25 to 28

Refer to the exhibit. You need to create a base SD-WAN configuration that includes SD-WAN rules and Performance SLAs for spoke sites with various connectivity types. It needs to be done in a way that can be easily applied to new sites with a minimum amount of change.

How should you create the SD-WAN zones?

• A. With no members configured
• B. With members and assign overlay interfaces
• C. With members without interface assignments
• D. With members and assign interfaces but do not specify a gateway

The FortiGate is an IPsec VPN hub. A VPN spoke protecting subnet 192.168.222.0/24 has successfully brought up a tunnel with the FortiGate.
This remote network is present in the FortiGate routing table as shown in the exhibit.
Which statement is true?

• A. The route in the exhibit is bound to "BranchOffice_0" which is a tunnel other than "BranchOffice".
• B. The FortiGate administrator configured a static route for 192.168.222.0/24.
• C. The FortiGate administrator configured this subnet as a locally connected subnet on the
  "BranchOffice" phase1 interface.
• D. This subnet was learned during quick-mode negotiation and was dynamically injected into the routing table.