Instant Access Fortinet.NSE8_813.v2026-05-15.q83 Actual Practice Test Engine for Free (Page 3)

Question 6

You cannot ping the FortiGate default gateway 10.10.10.1 from the FortiGate CLI. The FortiGate interface facing the default gateway is wan1 and its IP address is 10.10.10.254/24. During the initial troubleshooting tests, you confirm that you can ping other IP addresses in the 10.10.10.0/24 subnet from the FortiGate CLI without packets lost.
Which two CLI commands will help you to troubleshoot this problem? (Choose two.)

A.diag sniffer packet wan1 'arp and host 10.10.10.1'
B.diagnose ip arp list
C.diagnose debug flow filter saddr 10.10.10.1
diagnose debug flow trace start 10
D.diagnose hardware deviceinfo nic wan1

Question 7

Your security department has requested that you implement the OpenSSL TLS Heartbeat lnformation disclosure signature using an IPS sensor to scan traffic destined to the FortiGate.
You must log all packets that attempt to exploit this vulnerability.
Referring to the exhibit, which two configurations are required to accomplish this task? (Choose two.)

A.
B.
C.
D.

Question 8

Refer to the CLI output:

Given the information shown in the output, which two statements are correct? (Choose two.)

A.Geographical IP policies are enabled and evaluated after local techniques
B.Attackers can be blocked before they target the servers behind the FortiWeb
C.The IP Reputation feature has been manually updated
D.An IP address that was previously used by an attacker will always be blocked
E.Reputation from blacklisted IP addresses from DHCP or PPPoE pools can be restored

Correct Answer: B,E

The CLI output shown in the exhibit indicates that FortiWeb has enabled IP Reputation feature with local techniques enabled and geographical IP policies enabled after local techniques (set geoip-policy-order after-local). IP Reputation feature is a feature that allows FortiWeb to block or allow traffic based on the reputation score of IP addresses, which reflects their past malicious activities or behaviors. Local techniques are methods that FortiWeb uses to dynamically update its own blacklist based on its own detection of attacks or violations from IP addresses (such as signature matches, rate limiting, etc.). Geographical IP policies are rules that FortiWeb uses to block or allow traffic based on the geographical location of IP addresses (such as country, region, city, etc.). Therefore, based on the output, one correct statement is that attackers can be blocked before they target the servers behind the FortiWeb. This is because FortiWeb can use IP Reputation feature to block traffic from IP addresses that have a low reputation score or belong to a blacklisted location, which prevents them from reaching the servers and launching attacks.
Another correct statement is that reputation from blacklisted IP addresses from DHCP or PPPoE pools can be restored. This is because FortiWeb can use local techniques to remove IP addresses from its own blacklist if they stop sending malicious traffic for a certain period of time (set local-techniques-expire-time), which allows them to regain their reputation and access the servers. This is useful for IP addresses that are dynamically assigned by DHCP or PPPoE and may change frequently.
Fortinet compiles a reputation for each public IP address. Clients will have poor reputations if they have been participating in attacks, willingly or otherwise. Because blacklisting innocent clients is equally undesirable, Fortinet also restores the reputations of clients that improve their behavior.
This is crucial when an infected computer is cleaned, or in DHCP or PPPoE pools where an innocent client receives an IP address that was previously leased by an attacker.

Question 9

A customer with a FortiDDoS 200F protecting their fibre optic internet connection from incoming traffic sees that all the traffic was dropped by the device even though they were not under a DoS attack. The traffic flow was restored after it was rebooted using the GUI.
Which two options will prevent this situation in the future? (Choose two.)

A.Change the Adaptive Mode.
B.Create an HA setup with a second FortiDDoS 200F.
C.Move the internet connection from the SFP interfaces to the LC interfaces.
D.Replace with a FortiDDoS 1500F.

Question 10

Refer to the exhibit, which shows diagnostic output.

A customer reports that ICMP traffic flow from 192.168.1.11 to 93.190.134.171 is not corresponding to the SD-WAN setup.
What is the problem in this scenario?

A.SD-WAN Rule is matching only DNS traffic.
B.Port1 is used because it has more available bandwidth.
C.Traffic is matched by policy route.
D.Route for the destination IP is missing in the routing table.

Question 6

Question 7

Question 8

Question 9

Question 10

Download PDF File