2026 New NSE8_813 Exam Questions Real Fortinet Dumps [Q116-Q132]

November 1, 2026 admin 0

Categories : NSE8_813 , Fortinet

Rate this post

2026 New NSE8_813 Exam Questions Real Fortinet Dumps

Course 2026 NSE8_813 Test Prep Training Practice Exam Download

Fortinet NSE8_813 Exam Syllabus Topics:

Section	Objectives
Topic 1: Fortinet Product Integration	– Multi-product deployment scenarios 1. FortiGate advanced configuration 2. Integration with FortiManager / FortiAnalyzer 3. Secure access and VPN solutions
Topic 2: Security Solutions Validation	– End-to-end solution validation 1. Policy enforcement testing 2. Configuration verification
Topic 3: Security Operations and Troubleshooting	– Incident analysis and troubleshooting 1. Log analysis and interpretation 2. Traffic flow troubleshooting
Topic 4: Advanced Enterprise Network Security Design	– Secure network architecture design with Fortinet solutions 1. Large-scale enterprise segmentation 2. High availability and redundancy design

NEW QUESTION 116
You must analyze an event that happened at 20:37 UTC.

One log relevant to the event is extracted from FortiGate logs:
The devices and the administrator are all located in different time zones Daylight savings time (DST) is disabled.
– The FortiGate is at GMT-10:00
– The FortiAnalyzer is at GMT-08:00
– Your browser local time zone is at GMT-03:00
You want to review this log on FortiAnalyzer GUI, what time should you use as a filter?

20:37:08

10:37:08

17:37:08

12:37:08

https://community.fortinet.com/t5/FortiAnalyzer/Technical-Note-Understanding-FortiAnalyzer- time-related-fields/ta-p/197569

NEW QUESTION 117
You notice that memory usage is high and FortiGate has entered conserve mode.
You want FortiGate’s IPS engine to focus only on exploits and attacks that are applicable to your specific network.
Which two steps would you take to reduce RAM usage without weakening security? (Choose two.)

Configure IPS to pass files that are larger than a specific threshold, instead of buffering and scanning them.

Reduce the size of the signature three (filters) that FortiGate must search by disabling scans for applications and OS stacks that do not exist on your network.

Disable application control for protocols that are not used on your network.

Disable IPS for traffic destined for the FortiGate itself.

NEW QUESTION 118
A customer is operating a FortiWeb cluster in a high volume active-active HA group consisting of eight FortiWeb appliances. One of the secondary members is handling traffic for one specific VIP.
What will happen with the traffic if that secondary FortiWeb appliance fails?

Traffic will be redirected to the next appliance in the same traffic group.

Traffic will be redistributed by the primary appliance to the remaining secondary appliances.

Traffic will be redistributed by the primary appliance to the remaining secondary appliances that are configured to handle traffic for that specific VIP.

Traffic will be redirected to the secondary member with the least number of sessions.

In an active-active FortiWeb HA cluster, traffic distribution is managed by the primary FortiWeb appliance. Each VIP is assigned to specific secondary appliances based on configuration. If one of the secondary appliances handling traffic for a specific VIP fails, the primary FortiWeb will redistribute the traffic among the remaining secondary appliances that are configured to handle that specific VIP. This ensures that only the appropriate appliances, which are part of the same traffic group or configuration for that VIP, handle the traffic.

NEW QUESTION 119
FortiMail is configured with the protected domain “internal.lab”.
Which two envelope addresses will need an access control rule to relay e-mail sent for unauthenticated users? (Choose two.)

MAIL FROM: [email protected]; RCPT TO: [email protected]

NEW QUESTION 120
Refer to the exhibit.

A customer wants to automate the creation and configuration of FortiGate VM instances in a VMware vCenter environment using Terraform. They have the creation part working with the code shown in the exhibit.
Which code snippet will allow Terraform to automatically connect to a newly deployed FortiGate if its IP was dynamically assigned by VMware NSX-T?

The customer wants to connect automatically to a newly deployed FortiGate VM whose IP address is dynamically assigned by VMware NSX-T. In Terraform, the correct way to reference the dynamically assigned IP address is by using the default_ip_addressattribute of the vsphere_virtual_machineresource.
The code snippet correctly references the dynamically assigned IP using:
hostname = vsphere_virtual_machine.vm.default_ip_address
This ensures that Terraform fetches the assigned IP address of the deployed FortiGate VM and uses it to connect to the instance for further configuration.

NEW QUESTION 121
FortiGatel has a gateway-to-gateway IPsec VPN to FortiGate2. The entire IKE negotiation between FortiGatel and FortiGate2 is on UDP port 500. A PC on FortuGate2’s local area network is sending continuous ping requests over the VPN tunnel to a PC of FortiGatel’s local area network. No other traffic is sent over the tunnel.
Which statement is true on this scenario?

FortiGatel sends an R-U-TH ERE packet every 300 seconds while ping traffic is flowing.

FortiGatel sends an R-U-TH ERE packet if pings stop for 300 seconds and no IKE packet is received during this period.

FortiGatel sends an R-U-THERE packet if pings stop for 60 seconds and no IKE packet is received during this period.

FortiGatel sends an R-U-TH ERE packet every 60 seconds while ping traffic is flowing.

http://kb.fortinet.com/kb/documentLink.do?externalID=FD35337

NEW QUESTION 122
The exhibit shows an LDAP server configuration on a FortiGate device.
The LDAP user, John Smith, has the following LDAP attributes:

John Smith’s LDAP password is ABC123.
Which CLI command should you use to test the LDAP authentication using John Smith’s credentials?

diagnose test authserver ldap Lab jsmith ABC123

diagnose test authserver ldap-direct Lab jsmith ABC123

diagnose test authserver ldap Lab ‘John Smith’ ABC123

diagnose test authserver ldap-direct Lab john ABC123

NEW QUESTION 123
A customer wants to use a central RADIUS server for management authentication when connecting to the FortiGate GUI and to provide different levels of access for different types of employees.
Which three actions are required to provide the requested functionality? (Choose three.)

Create a wildcard administrator on the FortiGate.

Enable radius-vdom-override in the CLI.

Create multiple administrator profiles with matching RADIUS VSAs.

Enable accprofile-override in the CLI.

Set the RADIUS authentication type to MS-CHAPv2.

NEW QUESTION 124
Refer to the exhibit.

Only users authenticated in FortiGate-B can reach the server. A customer wants to deploy a single sign-on solution for IPsec VPN users. Once a user is connected and authenticated to the VPN in FortiGate-A, the user does not need to authenticate again in FortiGate-B to reach the server.
Referring to the exhibit, which two actions satisfy this requirement? (Choose two.)

Use Kerberos authentication.

Use the Collector Agent.

Use FortiAuthenticator.

FortiGate-A must generate a RADIUS accounting packet.

NEW QUESTION 125
A customer has a SCADA environmental control device that is triggering a false-positive IPS alert whenever the Web GUI of the device is accessed. You cannot create a functional custom IPS filter to exempt this behavior, and it appears that the device is so old that it does not have HTTPS support. You need to prevent the false positive IPS alerts from occurring.
In this scenario, which two actions will accomplish this task? (Choose two.)

Create a URL filter with the Exempt action for that device IP address.

Change the relevant firewall policies to use SSL certificate-inspection instead of SSL deep- inspection.

Create a very specific firewall policy for that device IP address which does not perform IPS scanning.

Reconfigure the FortiGate to operate in proxy-based inspection mode instead of flow-based.

NEW QUESTION 126
Refer to the exhibit containing the configuration snippets from the FortiGate.

Customer requirements:
SSLVPN Portal must be accessible on standard HTTPS port (TCP/443)
Public IP address (129.11.1.100) is assigned to port1
Datacenter.acmecorp.com resolves to the public IP address assigned to port1 The customer has a Let’s Encrypt certificate that is going to expire soon and it reports that subsequent attempts to renew that certificate are failing.
Reviewing the requirement and the exhibit, which configuration change below will resolve this issue?

https://docs.fortinet.com/document/fortigate/7.4.1/administration-guide/822087/automatically- provision-a-certificate The redirect on port 80 will block the acme request

NEW QUESTION 127
A customer’s cybersecurity department needs to implement security for the traffic between two VPCs in AWS, but these belong to different departments within the company. The company uses a single region for all their VPCs.
Which two actions will achieve this requirement while keeping separate management of each departments VPC? (Choose two.)

Create a transit VPC with a FortiGate HA cluster, connect to the other two using VPC peering, and use routing tables to force traffic through the FortiGate cluster.

Create an IAM account for the cybersecurity department to manage both existing VPC, create a FortiGate HA Cluster on each VPC and IPSEC VPN to force traffic between the VPCs through the FortiGate clusters.

Migrate all the instances to the same VPC and create IAM accounts for each department, then implement a new subnet for a FortiGate auto-scaling group and use routing tables to force the traffic through the FortiGate cluster.

Create a VPC with a FortiGate auto-scaling group with a Transit Gateway attached to the three VPC to force routing through the FortiGate cluster.

To implement security for the traffic between two VPCs in AWS, while keeping separate management of each department’s VPC, two possible actions are:
Create a transit VPC with a FortiGate HA cluster, connect to the other two using VPC peering, and use routing tables to force traffic through the FortiGate cluster. This option allows the cybersecurity department to manage the transit VPC and apply security policies on the FortiGate cluster, while the other departments can manage their own VPCs and instances. The VPC peering connections enable direct communication between the VPCs without using public IPs or gateways. The routing tables can be configured to direct all inter-VPC traffic to the transit VPC.
Create a VPC with a FortiGate auto-scaling group with a Transit Gateway attached to the three VPCs to force routing through the FortiGate cluster. This option also allows the cybersecurity department to manage the security VPC and apply security policies on the FortiGate cluster, while the other departments can manage their own VPCs and instances. The Transit Gateway acts as a network hub that connects multiple VPCs and on-premises networks. The routing tables can be configured to direct all inter-VPC traffic to the security VPC.
https://docs.fortinet.com/document/fortigate-public-cloud/7.2.0/aws-administration- guide/506140/connecting-a-local-fortigate-to-an-aws-vpc-vpn
https://docs.fortinet.com/document/fortigate-public-cloud/7.0.0/sd-wan-architecture-for- enterprise/166334/sd-wan-configuration

NEW QUESTION 128
Refer to the exhibit.

As shown in the exhibit, a FortiADC is load-balancing IPv4 traffic between two next-hop routers.
The FortiADC does not know the IP addresses of the servers. Also, the FortiADC is doing Layer 7 content inspection and modification.
In this scenario, which application delivery control is configured in the FortiADC?

Layer 3

Layer 4

Layer 7

Layer 2

NEW QUESTION 129
You are asked to write a FortiAnalyzer report that lists the session that has consumed the most bandwidth. You are required to include the source IP, destination IP, application, application category, hostname, and total bandwidth consumed.
Which dataset meets these requirements?

select from_itime(itime) as timestamp, srcip, dstip, app, appcat, hostname, sum(coalesce(‘sentbyte”,
0) +coalesce(‘recbyte “, O)) as bandwidth from $log where $filter LIMIT 1

select from_itime(itime) as timestamp, srcip, dstip, app, appcat, hostname, sum(coalesce(‘sentbyte”,
0) +coalesce(‘recbyte”, O)) as bandwidth from $log where $filter LIMIT 1

select from_itime(itime) as timestamp, srcip, dstip, app, appcat, hostname, sum(coalesce(‘sentbyte”,
0) +coalesce(‘rcvdbyte”, O)) as bandwidth from $log where $filter LIMIT 1

select from_itime(itime) as timestamp, sourceip, destip, app, appcat, hostname, sum(coalesce(‘sentbyte’, O)+coalesce(‘rcvdbyte”, O)) as bandwidth from $log where $filter LIMIT 1

NEW QUESTION 130
Refer to the exhibit showing the history logs from a FortiMail device.

Which FortiMail email security feature can an administrator enable to treat these emails as spam?

DKIM validation in a session profile

Sender domain validation in a session profile

Impersonation analysis in an antispam profile

Soft fail SPF validation in an antispam profile

Impersonation analysis is a feature that detects emails that attempt to impersonate a trusted sender, such as a company executive or a well-known brand, by using spoofed or look-alike email addresses. This feature can help prevent phishing and business email compromise (BEC) attacks. Impersonation analysis can be enabled in an antispam profile and applied to a firewall policy.
https://docs.fortinet.com/document/fortimail/7.2.0/cookbook/221814/protecting-against-email- impersonation-in-fortimail

NEW QUESTION 131
Which statements are correct properties of a partial mesh VPN deployment. (Choose two.)

VPN tunnels interconnect between every single location.

VPN tunnels are not configured between every single location.

Some locations are reached via a hub location.

There are no hub locations in a partial mesh.

https://docs.fortinet.com/uploaded/files/1086/fortigate-ipsec-vpn-50.pdf (page 64)

NEW QUESTION 132
Refer to the exhibit.

While deploying a new FortiGate-VMX Security node, an administrator receives the error message shown in the exhibit.
In this scenario, which statement is correct?