[Q121-Q144] Pass Fortinet NSE8_813 Exam in First Attempt Guaranteed [Sep-2026]

Rate this post

Pass Fortinet NSE8_813 Exam in First Attempt Guaranteed [Sep-2026]

Exam Sure Pass Fortinet Certification with NSE8_813 exam questions

Fortinet NSE8_813 Exam Syllabus Topics:

Section	Objectives
Topic 1: Secure Networking Design	– Enterprise Security Architecture 1. Design secure SD-WAN deployments 2. Integrate Fortinet security fabric components 3. Implement high availability solutions 4. Design secure enterprise network topologies
Topic 2: Troubleshooting and Diagnostics	– Advanced Troubleshooting 1. Interpret logs and system events 2. Troubleshoot routing and switching issues 3. Analyze packet flow and debug outputs 4. Diagnose VPN and authentication failures
Topic 3: Operational Security and Best Practices	– Operational Management 1. Apply security hardening best practices 2. Implement backup and disaster recovery 3. Perform upgrade and migration planning 4. Maintain enterprise security compliance
Topic 4: Security Fabric Integration	– Fortinet Ecosystem Integration 1. Configure automation stitches 2. Integrate FortiManager and FortiAnalyzer 3. Implement centralized security management 4. Deploy zero trust network access
Topic 5: Advanced FortiGate Configuration	– FortiGate Enterprise Features 1. VPN and IPsec troubleshooting 2. Authentication and identity integration 3. Application control and SSL inspection 4. Advanced routing and policy configuration

Q121. Refer to the exhibit.

Only users authenticated in FortiGate-B can reach the server. A customer wants to deploy a single sign-on solution for IPsec VPN users. Once a user is connected and authenticated to the VPN in FortiGate-A, the user does not need to authenticate again in FortiGate-B to reach the server.
Referring to the exhibit, which two actions satisfy this requirement? (Choose two.)

Use Kerberos authentication.

Use the Collector Agent.

Use FortiAuthenticator.

FortiGate-A must generate a RADIUS accounting packet.

Q122. Refer to the exhibit.

The FortiAP profile used by the FortiGate managed AP is shown in the exhibit.
Which two statements in this scenario are correct? (Choose two.)

Interference will be prevented between FortiAP devices using this profile.

This profile will map specific SSIDs available to the FortiAP devices.

All FortiAP devices using this profile will have Radio 1 monitor wireless clients.

All FortiAP devices using this profile will have Radio 1 scan rogue access points.

Q123. You are installing a new FortiAP as shown on the exhibit, however, the FortiAP cannot discover the FortiGate. The FortiAP obtained an IP from the DHCP server and is reachable.
Which two configurations will resolve the problem? (Choose two.)

Q124. A customer’s cybersecurity department needs to implement security for the traffic between two VPCs in AWS, but these belong to different departments within the company. The company uses a single region for all their VPCs.
Which two actions will achieve this requirement while keeping separate management of each departments VPC? (Choose two.)

Create a transit VPC with a FortiGate HA cluster, connect to the other two using VPC peering, and use routing tables to force traffic through the FortiGate cluster.

Create an IAM account for the cybersecurity department to manage both existing VPC, create a FortiGate HA Cluster on each VPC and IPSEC VPN to force traffic between the VPCs through the FortiGate clusters.

Migrate all the instances to the same VPC and create IAM accounts for each department, then implement a new subnet for a FortiGate auto-scaling group and use routing tables to force the traffic through the FortiGate cluster.

Create a VPC with a FortiGate auto-scaling group with a Transit Gateway attached to the three VPC to force routing through the FortiGate cluster.

Q125. An administrator has configured a FortiGate device to authenticate SSL VPN users using digital certificates. A FortiAuthenticator is the certificate authority (CA) and the OCSP server.
Part of the FortiGate configuration is shown below:

Based on this configuration, which authentication scenario will FortiGate deny?

The user certificate does not contain the OCSP URL.

FortiAuthenticator responds to an OCSP request that the user certificate authority is untrusted.

FortiAuthenticator responds to an OCSP request that the user certificate status is unknown.

The user certificate does not contain User Principal Name (UPN) information.

Q126. A customer is authenticating users using a FortiGate and an external LDAP server. The LDAP user, John Smith, cannot authenticate. The administrator runs the debug command diagnose debug application fnbamd 255 while John Smith attempts the authentication:
Based on the output shown in the exhibit, what is causing the problem?

The LDAP administrator password in the FortiGate configuration is incorrect.

The user, John Smith, does have an account in the LDAP server.

The user, John Smith, does not belong to any allowed user group.

The user, John Smith, is using an incorrect password.

Q127. Refer to the exhibits.
Topology

Configuration

A customer has deployed a FortiGate with iBGP and eBGP routing enabled. HQ is receiving routes over eBGP from ISP 2; however, only certain routes are showing up in the routing table.
Assume that BGP is working perfectly and that the only possible modifications to the routing table ate solely due to the prefix list that is applied on HQ.
Given the exhibits, which two routes will be active in me routing table on the HQ firewall?
(Choose two.)

172.16.204.128/25

172.16.201.96/29

172.16.201.64/27

172.16.204.64/27

Q128. Refer to the exhibit.

Central NAT was configured on a FortiGate firewall. A sniffer shows ICMP packets out to a host on the Internet egresses with the port1 IP address instead of the virtual IP (VIP) that was configured Referring to the exhibit, which configuration change will ensure that ICMP traffic is also translated?

Q129. Refer to the exhibit showing the history logs from a FortiMail device.

Which FortiMail email security feature can an administrator enable to treat these emails as spam?

DKIM validation in a session profile

Sender domain validation in a session profile

Impersonation analysis in an antispam profile

Soft fail SPF validation in an antispam profile

Q130. A FortiGate is used as a VPN hub for a number of remote spoke VPN units (Group A) spokes using a phase 1 main mode dial-up tunnel and pre-shared keys. You are asked to establish VPN connectivity for a newly acquired organization’s sites for which new devices will be provisioned Group B spokes.
Both existing Group A and new Group B spoke units are dynamically addressed through a single public IP Address on the hub. You are asked to ensure that spokes from Group B have different access permissions than the existing VPN spokes units Group A.
Which two solutions meet the requirements for the new spoke group? (Choose two.)

Implement a new phase 1 dial-up main mode tunnel with a different pre-shared key than the Group A spokes.

Implement a new phase 1 dial-up main mode tunnel with certificate authentication.

Implement a new phase 1 dial-up main mode tunnel with pre-shared keys and XAuth.

Implement separate phase 1 dial-up aggressive mode tunnels with a distinct peer ID.

Q131. Examine the two static routes to the same destination subnet 172.20.168.0/24 as shown below; then answer the question following it.
config router static
edit 1
set dst 172.20.168.0 255.255.255.0
set distance 20
set priority 10
set device port1
next
edit 2
set dst 172.20.168.0 255.255.255.0
set distance 20
set priority 20
set device port2
next
end
Which of the following statements correctly describes the static routing configuration provided above?

The FortiGate evenly shares the traffic to 172.20.168.0/24 through both routes.

The FortiGate shares the traffic to 172.20.168.0/24 through both routes, but the port2 route will carry approximately twice as much of the traffic.

The FortiGate sends all the traffic to 172.20.168.0/24 through port1.

Only the route that is using port1 will show up in the routing table.

Q132. Refer to the exhibit.

Given the exhibit, which two statements about FortiGate FGSP HA cluster behavior are correct?
(Choose two.)

You can run FortiGate Virtual Router Redundancy Protocol (VRRP) high availability in addition to FGSP simultaneously.

Session synchronization occurs over Layer 3 by default, and if unavailable it will then try Layer 2.

You can selectively synchronize only specific sessions between FGSP cluster members.

Cluster members will upgrade one at a time and failover during firmware upgrades.

Q133. Virtual Domains (VDOMs) allow a FortiGate administrator to do what?

Group two or more FortiGate units to form a single virtual device.

Split a physical FortiGate unit into multiple virtual devices.

Create multiple VLANs in a single physical interface,

Group multiple physical interfaces to form a single virtual interface.

Q134. You are running a diagnose command continuously as traffic flows through a platform with NP6 and you obtain the following output:

Given the information shown in the output, which statement is true?

Enable HPE shaper for the NP6 will change the output

There are packet drops at the XAUI

The output is showing a packet descriptor queue counter of accepted packets

Host-shortcut mode is enabled

Q135. Refer to the exhibits.
Exhibit A

Exhibit B

Exhibit C

A customer is trying to set up a VPN with a FortiGate, but they do not have a backup of the configuration. Output during a troubleshooting session is shown in the exhibits A and B and a baseline VPN configuration is shown in Exhibit C.
Referring to the exhibits, which configuration will restore VPN connectivity?

Q136. The FortiGate is used as an IPsec gateway at a branch office. Two tunnels, tunA and tunB, are established between this FortiGate and the headquarters’ IPsec gateway. The branch office’s subnet is 10.1.1.0/24. The headquarters’ subnet is 10.2.2.0/24.
The desired usage for tunA and tunB has been defined as follows:
– sessions initiated from 10.1.1.0/24 to 10.2.2.0/24 must be routed out over tunA when tunA is up
– sessions initiated from 10.1.1.0/24 to 10.2.2.0/24 have to be routed
out over tunB when tunA is down
– sessions initiated from 10.2.2.0/24 can ingress either on tunA or on
tunB
Which static routing configuration meets the requirements?

Q137. Refer to the exhibits.

You are configuring a Let’s Encrypt certificate to enable SSL protection to your website. When FortiWeb tries to retrieve the certificate, you receive a certificate status failed, as shown below.

Based on the Server Policy settings shown in the exhibit, which two configuration changes will resolve this issue? (Choose two.)

Disable Redirect HTTP to HTTPS in the Server Policy.

Remove the Web Protection Profile from this Server Policy.

Enable HTTP service in the Server Policy.

Configure a TXT record of the domain and point to the IP address of the Virtual Server.

Q138. Refer to the exhibit.

What is happening in this scenario?

The user status changed at FortiClient EMS to off-net.

The user is authenticating against a FortiGate Captive Portal.

The user is authenticating against an IdP.

The user has not authenticated on their external browser.

Q139. Refer to the exhibits.
Exhibit A

Exhibit B

A customer is looking for a solution to authenticate the clients connected to a hardware switch interface of a FortiGate 400E.
Referring to the exhibits, which two conditions allow authentication to the client devices before assigning an IP address? (Choose two.)

FortiGate devices with NP6 and hardware switch interfaces cannot support 802.1X authentication

Devices connected directly to ports 3 and 4 can perform 802.1X authentication

Ports 3 and 4 can be part of different switch interfaces

Client devices must have 802.1X authentication enabled

Q140. A legacy router has been replaced by a FortiGate device. The FortiGate has inherited the management IP address of the router and now the network administrator needs to remove the router from the FortiSIEM configuration.
Which two statements about this operation are true? (Choose two.)

FortiSIEM will move the router device into the Decommission folder.

The router will be completely deleted from the FortiSIEM database.

By default, FortiSIEM can only parser event logs for FortiGate devices.

FortiSIEM will discover a new device for the FortiGate with the same IP.

Q141. An administrator wants to assign static IP addresses to users connecting tunnel-mode SSL VPN.
Each SSL VPN user must always get the same unique IP address which is never assigned to any other user.
Which solution accomplishes this task?

TACACS+ authentication with an attribute-value (AV) pair containing each user’s IP address.

RADIUS authentication with each user’s IP address stored in a Vendor Specific Attribute (VSA).

LDAP authentication with an LDAP attribute containing each user’s IP address.

FSSO authentication with an LDAP attribute containing each user’s IP address.

Q142. A customer has a SCADA environmental control device that is triggering a false-positive IPS alert whenever the Web GUI of the device is accessed. You cannot create a functional custom IPS filter to exempt this behavior, and it appears that the device is so old that it does not have HTTPS support. You need to prevent the false positive IPS alerts from occurring.
In this scenario, which two actions will accomplish this task? (Choose two.)

Create a URL filter with the Exempt action for that device IP address.

Change the relevant firewall policies to use SSL certificate-inspection instead of SSL deep- inspection.

Create a very specific firewall policy for that device IP address which does not perform IPS scanning.

Reconfigure the FortiGate to operate in proxy-based inspection mode instead of flow-based.

Q143. Refer to the exhibits.

The exhibits show a FortiGate network topology and the output of the status of high availability on the FortiGate.
Given this information, which statement is correct?

This HA configuration uses layer 2 frames for the heartbeat.

FGVMEVLQOG33WM3D and FGVMEVGCJNHFYI4A share a virtual MAC address.

The cluster setup can support more than two (2) FortiGate VMs.

The cluster members are on the same network and the IP addresses were statically assigned.

Q144. Refer to the exhibit. You are deploying a FortiGate 6000F. The device should be directly connected to a switch. In the future, a new hardware module providing higher speed will be installed in the switch, and the connection to the FortiGate must be moved to this higher-speed port.
You must ensure that the initial FortiGate interface connected to the switch does not affect any other port when the new module is installed and the new port speed is defined.
How should the initial connection be made?