Fortinet NSE 8 Practice Test

NSE 8 practice test: what's covered

• Network Security Expert
• Security Fabric & Multi-Product

Free NSE 8 sample questions

1. A Security Fabric deployment has a root FortiGate, two downstream FortiGates, a FortiSwitch stack and several FortiAPs managed by the root. After upgrading the root from 7.2 to 7.4, the downstream FortiGates show "Fabric Connector: Disconnected" and the FortiSwitches appear "Unauthorized" although they were authorized before. What is the MOST LIKELY single root cause?

   • A. Downstream FortiGates are running an older firmware that mismatches the root Fabric major version, so the Fabric trust handshake fails and FortiLink trust must be re-authorized
   • B. The Security Fabric license expired during the upgrade
   • C. CSF (Cooperative Security Fabric) requires re-entering the Fabric password on every upgrade
   • D. FortiSwitch lost its DHCP lease on the FortiLink interface
   Show answer

   Correct: A. Security Fabric requires all members to be within one minor version of the root. After a major upgrade of the root, downstream FortiGates must also be upgraded; until they are, CSF refuses the trust handshake and FortiLink-connected switches lose their authorization. A Fabric password mismatch (B) would have blocked join from day one — it would not "disappear" after an upgrade. Licensing (B in C placement) does not affect connector state in this way.

2. Which THREE prerequisites are required for FortiGate to automatically push a discovered IoC from FortiAnalyzer to a quarantine action on a FortiSwitch port? (Choose 3)

   • A. Security Fabric must be formed with the FortiGate as root and the FortiSwitch managed via FortiLink
   • B. FortiAnalyzer must be authorized in the Security Fabric and event handlers configured to push tags or quarantine
   • C. Automation Stitch on FortiGate must trigger on FortiAnalyzer event and call "Quarantine FortiClient via EMS" action
   • D. A FortiSwitch automation action (Quarantine host on switch port) must be referenced by the stitch
   • E. The host must have a public IP address
   • F. FortiManager must be in the Fabric
   Show answer

   Correct: A and B and D. For end-to-end IoC → quarantine on switch port: (1) FortiLink-managed FortiSwitch in Fabric, (2) FortiAnalyzer Fabric-authorized so it can drive events, (4) an Automation Stitch with the FortiSwitch quarantine action. EMS quarantine is a different action for endpoints, not switch ports. FortiManager is optional. Public IP irrelevant — MAC is used on the switch port.

3. You see this output on the root FortiGate: <pre>diagnose sys csf members FGT60F-Root (root) up FGT100F-DC1 (downstream) up FGT60F-Branch01 (downstream) DOWN reason: serial conflict </pre> What is the cause and the correct remediation?

   • A. Two devices were cloned from the same VM template and now share the same serial — re-provision the branch VM so it gets a unique serial number
   • B. The branch device is using the wrong Fabric password
   • C. FortiGuard rating is down on the branch
   • D. The branch is missing a Fabric license
   Show answer

   Correct: A. "reason: serial conflict" appears when two Fabric members report the same serial — almost always a VM clone problem. CSF uses serial as the unique identity; password/license issues report different reasons. Re-provision the VM (or run "execute vm-license" to regenerate) so the duplicate is resolved.

4. A user on a FortiClient-EMS-managed endpoint scans a suspicious file. FortiClient sends it to FortiSandbox via FortiGate. Which sequence is correct?

   • A. FortiClient → FortiSandbox (direct upload via 514/TCP), with FortiGate only logging the verdict
   • B. FortiClient → FortiGate (inline AV proxy) → FortiSandbox; verdict returns to FortiGate which pushes IoC + dynamic AV signatures via Security Fabric to FortiClient and downstream FortiGates
   • C. FortiClient → FortiSIEM → FortiSandbox
   • D. FortiClient → FortiAuthenticator → FortiSandbox
   Show answer

   Correct: B. Standard chain: AV proxy on FortiGate uploads unknown samples to FortiSandbox, verdict returns to FortiGate, which propagates the dynamic AV signature to peers and to FortiClient via EMS. FortiClient can also upload directly when configured, but in a Fabric deployment FortiGate is the canonical aggregation point so peers benefit from the verdict.

5. On a managed FortiSwitch, you see ports flapping "STP topology change" every few seconds and CPU spiking on the switch. Which TWO investigation paths are MOST appropriate from the root FortiGate? (Choose 2)

   • A. diagnose switch-controller switch-info stp instance to see which port is causing TC events
   • B. execute switch-controller diagnose-switch <serial> "show spanning-tree detail" to read switch-side STP counters
   • C. diagnose hardware deviceinfo nic to read PHY counters on FortiGate
   • D. diagnose firewall iprope list to see policy ID mappings
   Show answer

   Correct: A and B. Both commands let the FortiGate (root) introspect the managed FortiSwitch via FortiLink. The first surfaces topology-change-source per VLAN instance; the second runs a CLI passthrough on the switch itself. "diagnose hardware deviceinfo nic" reads FortiGate physical NICs (irrelevant to switch STP). iprope is policy compilation — unrelated.

Last updated: 2026-10-19

NSE 8 practice test FAQ

Related practice tests

• FortiGate FCP_FGT_AD-7.4 practice test
• Fortinet FCSS_EFW_AD-7.6 practice test
• Fortinet NSE4 practice test
• Fortinet NSE 5 practice test
• Fortinet NSE7-EFW practice test