These practice questions are original and hand-written as a personal aid while studying for the Fortinet NSE8 exam. Content may or may not be applicable to any specific exam levels, but may be useful for the NSE4, NSE7, NSE8, FCP, or FCSS FortiGate exams. No questions are pulled from actual exams. Content is sourced from and fact-checked via official Fortinet Documentation.
Question 1
You have a multicast source that hops through your FortiGate firewalls before reaching the receiver device. The source and receiver devices are not in the same broadcast domain. You notice that multicast packets are being dropped before reaching their final destination. On your FortiGate, you run a packet sniffer specific to your multicast traffic and see the following output. Which configuration below, applied to your FortiGates, will allow traffic to reach its final destination?
Show Answer and Explanation
Answer:
config system settings
set multicast-ttl-notchange enable
end
Explanation:
The screenshot shows captured packets with a TTL of 1 when they pass through the FortiGate. When packets pass through FortiGate, the TTL will decrement by 1, therefore if a packet doesn’t have a TTL of 2 or higher when it reaches the FortiGate, it will be dropped. Multicast packets will sometimes source with a TTL of 1, common with link-local multicast traffic. The multicast-ttl-notchange setting, when enabled, will not decrement the TTL from 1 to 0, which would have caused the packet to be dropped. Assuming the multicast packet continues to flow through routers that do not decrement TTL, or the next hop is the multicast destination itself, the packet will reach the destination.
None of the other listed options will fix the TTL=1 issue.
set multicast-routing enable is a pre-requisite for multicast traffic to traverse broadcast domains, but does not fix the TTL issue causing traffic to be dropped.
set multicast-forward enable allows multicast forwarding, which doesn’t apply since the source and receiver are on different broadcast domains.
set ses-denied-multicast-traffic disable will have FortiGate not create sessions for denied multicast traffic. This setting is enabled to reduce CPU usage and improve performance, but does not affect the TTL=1 issue.
Question 2
You have configured SLAAC for IPv6 addressing to a downstream device, but the device is not receiving an IPv6 address. You have verified all device-level network settings are correct. Your SLAAC-serving interface is configured as follows:config system interface
edit "port2"
set vdom "root"
set type physical
set description "internal"
set alias "Inside"
config ipv6
set ip6-address fd00:c74c:7fe5::4/128
set ip6-mode staticWhat two configurations need to be made to allow the downstream device to receive an IPv6 address?
set ip6-allowaccess ping
set ip6-send-adv disable
set ip6-other-flag enable
config ip6-prefix-list
edit fd00:c74c:7fe5:3::/96
next
end
end
Show Answer and Explanation
Answer:
Replace fd00:c74c:7fe5:3::/96 with fd00:c74c:7fe5:3::/64
and
set ip6-send-adv enable
Explanation:
You must replace fd00:c74c:7fe5:3::/96 with fd00:c74c:7fe5:3::/64 as SLAAC only works when the prefix is a /64.
set ip6-send-adv enable is the required line of configuration for SLAAC on FortiGate.
None of the other options will affect SLAAC.
set dhcp6-relay-service enable configures the interface to relay DHCPv6 requests from clients to a DHCPv6 server outside of the interface. This is the IPv6 equivalent to the IPv4 DHCP relay configuration, set dhcp-relay-service enable.
set ip6-mode dhcp configures the interface to act as a DHCPv6 client. this is the IPv6 equivalent to the IPv4 interface addressing configuration, set mode dhcp.
Question 3
A firewall policy is matched with the following configurations. What session TTL will be applied to the matching session?config firewall policy
edit 3
set name "Policy 3"
set srcintf "any"
set dstintf "any"
set action accept
set srcaddr "all"
set dstaddr "10.0.0.0/8"
set schedule "always"
set service "TCP 433"
set utm-status enable
set ssl-ssh-profile "certificate-inspection"
set application-list "default"
set logtraffic all
set session-ttl 1200
next
end
config application list
edit "default"
config entries
edit 1
set action pass
set session-ttl 1500
next
end
end
config firewall service custom
edit "TCP 433"
set tcp-portrange 433
set session-ttl 900
next
end
config system session-ttl
set default 3600
end
Show Answer and Explanation
Answer:
1500 seconds
Explanation:
The configurations shown are the four places you can customize a session’s TTL. The configurations take higher priority in the following order:
1) Application Control Profile Session TTL
2) Custom Service Session TTL
3) Firewall Policy Session TTL
4) Global Session TTL
All four configurations apply to the listed firewall policy, including the “default” Application Control Profile, which has a custom session TTL set to 1500 seconds.
Question 4
An IPsec tunnel connects two FortiGate firewalls. You are trying to bring up an OSPF adjacency between the firewalls, but it’s showing the following state and won’t progress past it. What configuration change should you make to bring the adjacency up?
On FortiGate-A:config router ospf
set router-id 10.100.1.1
config area
edit 0.0.0.0
next
end
config ospf-interface
edit "Hub-and-Spoke"
set interface "Hub-and-Spoke"
set authentication message-digest
set keychain "ospf"
set dead-interval 40
set hello-interval 10
set mtu 1400
set network-type point-to-multipoint
next
end
config network
edit 1
set prefix 10.100.1.1 255.255.255.255
next
edit 2
set prefix 172.20.0.0 255.255.255.252
next
end
On FortiGate-B:config router ospf
set router-id 10.200.1.1
config area
edit 0.0.0.0
next
end
config ospf-interface
edit "Hub-and-Spoke"
set interface "Hub-and-Spoke"
set authentication message-digest
set keychain "ospf"
set dead-interval 40
set hello-interval 10
set mtu-ignore enable
set network-type point-to-point
next
end
config network
edit 1
set prefix 10.200.1.1 255.255.255.255
next
edit 2
set prefix 172.20.0.0 255.255.255.252
next
end
Show Answer and Explanation
Answer:
On FortiGate-A, set mtu-ignore enable
Explanation:
OSPF coming up to the Exchange start (ExStart) state, but not moving further, is a classic MTU mismatch problem. By default, OSPF routers connected by an IPsec tunnel will have an MTU of 1420 on both IPsec interfaces. In the question config, FortiGate-A’s OSPF interface has a custom MTU of 1400 set, mismatching with FortiGate-B’s default 1420.
On FortiGate-A, the set mtu-ignore enable configuration will tell OSPF to ignore the MTU mismatch and bring the OSPF adjacency up anyways.
None of the other answers will bring the OSPF adjacency up.
On FortiGate-A, set network-type point-to-point will not bring up the adjacency as a point-to-multipoint and point-to-point interface are compatible.
On FortiGate-A, set mtu 1500 will not bring up the adjacency as the FortiGate-A MTU will still not match the default IPsec interface MTU on FortiGate-B of 1420.
On FortiGate-B, edit1, set prefix 10.100.1.1 255.255.255.255 will not bring up the adjacency, it will just change the advertised network to FortiGate-A.
Question 5
Which of the following networks will be advertised to BGP peer, 10.100.1.1?
On AzFW02 (root):config router bgp
set as 100
set ebgp-multipath enable
config neighbor
edit "10.100.1.1"
set ebgp-enforce-multihop enable
set soft-reconfiguration enable
set interface "BGP Loopback"
set remote-as 100
set update-source "BGP Loopback"
next
end
config network
edit 1
set prefix 10.251.0.0 255.255.0.0
next
edit 2
set prefix 10.200.1.1 255.255.255.255
next
edit 3
set prefix 55.55.55.55 255.255.255.255
next
end
config redistribute "connected"
end
config redistribute "static"
set status enable
end end
Show Answer and Explanation
Answer:
10.251.0.0/16
10.200.1.1/32
172.20.0.1/32
Explanation:
10.251.0.0/16 and 10.200.1.1/32 will be advertised because they are configured within the BGP networks list and there are routes to both subnets in AzFW02’s route table.
172.20.0.1/32 will be advertised because it is a static type route and BGP is configured to redistribute static routes. The subnet is also present in AzFW02’s route table.
10.101.1.0/24 will not be advertised as BGP is not configured to redistribute connected routes nor is the subnet configured within the BGP networks list.
55.55.55.55/32 is configured within the BGP networks list, but there is not a route to the subnet within AzFW02’s route table.
Question 6
A FortiGate is seeing much higher CPU usage than usual after a junior admin made multiple configuration changes, leading to performance throttling. Which changes, if reverted, should improve steady-state performance conditions?
Show Answer and Explanation
Answer:
config system global
set check-protocol-header strict
end
config system global
set tcp-timewait-timer 0
end
Explanation:
Setting check-protocol-header to strict disables all hardware offloading, increasing CPU usage.
Setting the tcp-timewait-timer to 0 sets an unlimited TCP time wait after TCP handshakes have closed, leaving all TCP sessions in the session table indefinitely, increasing CPU usage.
The IPS setting set fail-open enable will allow flow-based sessions to continue to flow while the FortiGate is in memory conserve mode. This will not directly lead to high CPU usage in steady-state.
The IPS setting set socket-size 512 will allow for additional data to be passed by the kernel to the IPS engine each time the engine samples packets. Raising this value from the previous value of 256 may lead to high memory issue but does not directly impact CPU usage in stead-state.
Question 7
You have two FortiGates configured in FGCP HA mode. Your primary FortiGate has the following config:config system ha
set group-name "HA"
set mode a-p
set password ENC [REDACTED PASSWORD HASH]
set hbdev "port2" 0
set override enable
set session-pickup enable
set priority 255
end
During a routine failover test from your active to passive unit, you notice that the following traffic flow takes a long time to reconnect after the failover.
What can be configured in your HA settings to speed up recovery of the traffic flow?
Show Answer and Explanation
Answer:
set session-pickup-connectionless enable
Explanation:
set session-pickup-connectionless enable enables session synchronization of UDP and ICMP sessions, allowing for the maintenance of the UDP (proto=6) session seen in the diagnostic output above.
set backup-hbdev port1 is a setting that assigns port1 to be the backup heartbeat interface. This will not improve session failover times.
set gratuitous-arps disable stops the sending of gratuitous ARP packets during HA failover events. Gratuitous ARP assists in the updating of connected devices’ MAC forwarding tables during failover. Disabling this setting will not improve session failover times, it will likely extend them.
set sync-config disable will stop the automated synchronization of configurations between HA devices. This will not improve session failover times.
Question 8
You log into your FortiGate device and navigate to the Automation page to configure an Automation Stitch, but are presented with this message:
Which of the following should be set on the FortiGate you’re currently logged into in order to allow you to create an Automation Stitch?
Question 9
Assuming full functionality and that these options are being directly compared, which of the following routes will be used for Gmail traffic? For reference, Google-Gmail’s internet service ID is 65646.
Show Answer and Explanation
Answer:
config router policy
edit 2
set output-device “port2”
set internet-service-id 65646
next
end
Explanation:
All three routes are valid. The listed route types are evaluated in the following order:
Policy-Based Routes > ISDB Routes > SD-WAN Routes
config router policy is a policy-based route configuration, therefore it is the right answer.
config system sdwan is an SD-WAN route rule configuration, less preferred than the policy-based route.
config router static is an ISDB route configuration, less preferred than the policy-based route.
Question 10
Which of the following CLI configurations would you find for this VPN tunnel under config vpn ipsec phase1-interface?
Show Answer and Explanation
Answer:
set childless-ike enable
Explanation:
We know that childless-ike is enabled because of the presence of PQC-KEM (IKE): yes. childless-ike is a required configuration for IKE PQC.
We know that set mode aggressive is disabled because of the presence of version: 2. Setting the phase 1 mode is only applicable when IKE is set to version 1.
We know that set nattraversal is enabled because of the presence of peer within the nat: me peer line as well as transport: UDP. If NAT-T was disabled, we would not be able to traverse NAT on the peer end, and transport would not take place over UDP. We can additionally see port 4500 in use, associated with NAT-T.
We know that set auto-discovery-receiver is not enabled and is actually disabled because of the line auto-discovery: 1 sender. This tells us that only auto-discovery-sender is enabled.
We know that set interface “Hub-and-Spoke” is not set because of the line interface: port1 4. This tells us that port1 is the interface binding for this tunnel.
Leave a Reply