NSE8

NSE8 practice questions, page 3 of 3, with answer review and explanations.

Question 11

FortiGate1 has a gateway-to-gateway IPsec VPN to FortiGate2. The entire IKE negotiation between FortiGate1 and FortiGate2 is on UDP port 500. A PC on FortuGate2s local area network is sending continuous ping requests over the VPN tunnel to a PC of FortiGate1s local area network. No other traffic is sent over the tunnel. Which statement is true on this scenario?

  1. FortiGate1 sends an R-U-THERE packet every 300 seconds while ping traffic is flowing.
  2. FortiGate1 sends an R-U-THERE packet if pings stop for 300 seconds and no IKE packet is received during this period.
  3. FortiGate1 sends an R-U-THERE packet if pings stop for 60 seconds and no IKE packet is received during this period.
  4. FortiGate1 sends an R-U-THERE packet every 60 seconds while ping traffic is flowing.

Question 12

The FortiGate is an IPsec VPN hub. A VPN spoke protecting subnet 192.168.222.0/24 has successfully brought up a tunnel with the FortiGate. This remote network is present in the FortiGate routing table as shown in the exhibit. Which statement is true?

  1. This subnet was learned during quick-mode negotiation and was dynamically injected into the routing table.
  2. The FortiGate administrator configured this subnet as a locally connected subnet on the "BranchOffice" phase1 interface.
  3. The route in the exhibit is bound to "BranchOffice_0" which is a tunnel other than "BranchOffice".
  4. The FortiGate administrator configured a static route for 192.168.222.0/24.

Question 13

There is an interface-mode IPsec tunnel configured between FortiGate1 and FortiGate2. You want to run OSPF over the IPsec tunnel. On both FortiGates. the IPsec tunnel is based on physical interface port1. Port1 has the default MTU setting on both FortiGate units. Which statement is true about this scenario?

  1. A multicast firewall policy must be added on FortiGate1 and FortiGate2 to allow protocol 89.
  2. The MTU must be set manually in the OSPF interface configuration.
  3. The MTU must be set manually on the IPsec interface.
  4. An IP address must be assigned to the IPsec interface on FortiGate1 and FortiGate2.