NSE8-812 Sample Questions & Answers

The correct, non-disruptive procedure for upgrading an MCLAG pair is to upgrade one switch at a time. The recommended practice is to first set the secondary (passive) peer to standalone mode, which isolates it from the MCLAG domain. After upgrading and rebooting the secondary switch, you can fail over traffic to it (by shutting down links on the primary or rebooting it) and then proceed with upgrading the original primary switch. This rolling upgrade process ensures that at least one switch is always active and forwarding traffic.

This solution leverages the existing central management infrastructure to create a scalable, automated, and fabric-wide response. FortiAnalyzer acts as the central detection point. The FortiAnalyzer-FortiManager webhook integration provides the trigger mechanism. FortiManager's automation stitch and scripting capabilities can then update a dynamic address group (like an IP list or threat feed) that is already part of a shared policy package. When this object is updated on FortiManager, the change is automatically pushed to all managed FortiGates, effectively quarantining the host across the entire organization in a synchronized and efficient manner.

Traffic shaping is a feature that requires CPU processing to manage queues and enforce bandwidth limits. When a traffic shaper is applied to a firewall policy, sessions matching that policy are sent to the CPU and cannot be offloaded to NP7 processors.

Proxy-based inspection mode requires the FortiGate to terminate and re-initiate connections to perform in-depth analysis. This process is handled by the CPU and the content processors (CPs), not the network processors (NPs). Therefore, traffic subject to proxy-based inspection cannot be offloaded to NP7.

Within the config user saml CLI context, the set group-claim parameter is used to define the name of the SAML attribute that the IdP will send to convey group membership. The FortiGate will parse the SAML assertion for this attribute (in this case, memberOf) to identify the user's groups and match them against FortiGate user groups for authorization.

FortiMail's Full HA mode provides the highest level of redundancy. In this mode, both configuration and mail data (including mail queues, user data, and archives) are continuously synchronized between the primary and secondary units. If the primary unit fails, the secondary unit has an identical, up-to-date copy of all data and can take over processing immediately, ensuring no emails are lost and service interruption is minimized.

On a FortiGate chassis system, the set port-mapping command under config load-balance setting is used to statically map an ingress port to a specific FIM (worker). This overrides the default hashing-based load balancing and ensures that all traffic from the specified port is directed to the designated FIM, providing deterministic traffic handling.

The statement is true. The purpose of packet duplication is to send identical copies of each packet across multiple SD-WAN member links simultaneously to improve reliability for latency-sensitive applications like VoIP. This inherently doubles (or triples, etc., depending on the number of duplicated paths) the amount of bandwidth consumed for that specific traffic stream.

The 'Isolate Device' action is the primary method in FortiEDR to contain a threat by blocking all network communication to and from the endpoint, except for communication with the FortiEDR management console.

The 'Collect File' action allows the playbook to automatically retrieve a copy of the specified malicious file from the endpoint and store it in the FortiEDR backend for further analysis by the security team.

The 'Kill Process' action is used to immediately terminate the running malicious process on the endpoint, stopping its activity and preventing further damage.

SSL/TLS Passthrough is a FortiWeb feature that allows the appliance to forward encrypted traffic directly to the backend server without decrypting and inspecting it. This is achieved by creating a server policy for HTTPS that does not have an SSL offloading or inspection profile applied. This configuration meets the requirement to let the backend servers handle the SSL/TLS termination while still allowing the FortiWeb to inspect unencrypted HTTP traffic through a separate policy.

FortiManager provides a 'Dynamic VDOM' option when running a script. When this is enabled, FortiManager does not hardcode the VDOM context in the script itself. Instead, it runs the script on the specific VDOM that is assigned to the policy package for that device. This allows a single, generic script to be applied to many devices, with FortiManager dynamically selecting the correct target VDOM on each FortiGate based on the policy package assignment.