Fortinet NSE 8 - Recertification Sample Questions:

1. Refer to the exhibit.

You created an aggregate interface between a FortiGate and a switch consisting of two 1 Gbps links as shown in the exhibit. However, the maximum bandwidth never exceeds 1 Gbps and employees are reporting that the network is slow. After troubleshooting, you notice that only one member interface is being used. The configuration for the aggregate interface is shown in the exhibit.
In this scenario, which command will solve this problem?

A)

B)

C)

D)

2. You are deploying a FortiExtender (FEX) on a ForiGate-60F. The FEX will be managed by the FortiGate. You anticipate high utilization. The requirement is to minimize the overhead on the device for WAN traffic.
Which action achieves the requirement in this scenario?

A) Add a switch between the FortiGate and FEX.
B) Change connectivity between the FortiGate and the FortiExtender to use VLAN Mode
C) Add a VLAN under the FEX-WAN interface on the FortiGate
D) Enable CAPWAP connectivity between the FortiGate and the FortiExtender

3. A customer has FortiAP devices in three branch offices managed from a FortiGate in the HQ.
Each FortiAP is connected to a dedicated management VLAN.
The customer wants the users connected to the FortiAP SSIDs to use the branch local internet connection, but each branch uses a different VLAN ID for the bridge. HQ users travel to different branches and connect to the same SSID.
Which configuration option will solve this requirement?

A) Use set vlan-pooling round-robin on the VAP configuration with the corresponding vlan-pool.
B) Set each FortiAP to a wtp-group and use set vlan-pooling wtp-group on the VAP configuration with the corresponding VLAN ID configuration for each group.
C) Use set vlan-pooling hash on the VAP configuration with the corresponding vlan-pool.
D) Set a FortiAuthenticator for 802.1x authentication with the Tunnel-Type attribute set to VLAN and use set dynamic-vlan enable on the VAP configuration.

4. A customer is planning on moving their secondary data center to a cloud-based IaaS. They want to place all the Oracle-based systems on Oracle Cloud, while the other systems will be on Microsoft Azure with ExpressRoute service to their main data center.
They have about 200 branches with two internet services as their only WAN connections. As a security consultant you are asked to design an architecture using Fortinet products with security, redundancy, and performance as a priority.
Which two design options are true based on these requirements? (Choose two.)

A) Systems running on Azure will need to go through the main data center to access the services on Oracle Cloud.
B) Branch FortiGate devices must be configured as VPN clients for the branches' internal network to be able to access Oracle services without using public IPs.
C) Two ExpressRoute services to the main data center are required to implement SD-WAN between a FortiGate VM in Azure and a FortiGate device at the data center edge.
D) Use FortiGate VM for IPSEC over ExpressRoute, as traffic is not encrypted by Azure.

5. A FortiGate deployment contains the following configuration:

What is the result of this configuration?

A) Route-maps are not configurable in VDOM SERVICES
B) Route-maps from the Root VDOM configuration are available in VDOM SERVICES
C) Route-maps for VDOM SERVICES are excluded from HA configuration synchronization
D) Route-maps from VDOM SERVICES are available in all other VDOMs

Solutions: