NSE8-812 Fortinet Certified Expert (FCX) - Cybersecurity Practice Questions

Area Border Routers (ABRs) are responsible for summarizing routes from one area and advertising them into another. These advertisements are sent as Type 3 Link-State Advertisements (LSAs), also known as Summary LSAs. Routers within an area will see these Type 3 LSAs in their database and install them as inter-area (O IA) routes in their routing table.

While set session-pickup enable is the primary command for enabling session synchronization, it only synchronizes basic session information by default. For stateful TCP sessions to be fully resilient to failover, TCP sequence numbers must also be synchronized. The set session-pickup-delay enable command (which requires session-pickup to be enabled) activates this enhanced TCP session synchronization. This ensures that the secondary unit has the correct sequence numbers to continue the conversation after a failover, preventing TCP resets and application disruption. Note: In modern FortiOS versions, this is often enabled by default when session-pickup is on, but knowing its function is key.

This configuration correctly establishes the required bidirectional communication paths while maintaining separation. 1) Each customer VDOM needs a route to the server and a policy to allow traffic out. 2) The root VDOM needs return routes to send traffic back to each customer. 3) Crucially, the root VDOM needs two separate firewall policies (one for each customer VDOM-to-server path). This ensures traffic is explicitly permitted from each customer to the shared resource, and because there is no policy allowing traffic between VLINK_A and VLINK_B, the customers remain isolated from each other.

To control which routes are advertised to a BGP peer, an outbound route-map is used. The administrator would first define a prefix-list to match the specific internal prefixes to be filtered. Then, a route-map is created that references this prefix-list with a deny action. Finally, this route-map is applied in the out direction to the BGP neighbor configuration, preventing the matched prefixes from being sent.

When packet duplication is enabled, the FortiGate sends copies of packets over multiple member interfaces. However, it still monitors the Performance SLA for each of those members. If a member (port2) fails to meet the SLA criteria (e.g., jitter is too high), the FortiGate will stop sending the duplicated packets over that specific link. It will continue to send the primary stream over the links that are still within the SLA (port1). This prevents the poor-performing link from negatively impacting the application while maintaining the benefit of the healthy link.

To achieve deterministic session handling and steer specific traffic to a designated FIM, policy-based session affinity is required. The set affinity-group command within a firewall policy allows an administrator to bind traffic matching that policy to a specific FIM, overriding the default load balancing behavior. This ensures high-priority traffic is handled by the preferred module, providing predictable performance and failover behavior.

In a dual-hub ADVPN setup, spokes connected to Hub A need to learn the routes for spokes connected to Hub B to trigger shortcut tunnel creation. The most effective way to achieve this is by establishing an iBGP peering between the two hubs. This allows each hub to share the routes learned from its connected spokes with the other hub, providing all spokes with a complete routing table of the entire ADVPN domain.

When nat is enabled on the firewall policy that handles the SD-WAN traffic, existing sessions are tied to the specific NAT IP of the outgoing interface (MPLS in this case). By default, FortiOS will not move an existing, NATed session to a new interface even if the SD-WAN rules dictate a path change. This is to prevent breaking the session, as the source IP would change mid-session. New sessions are not affected and will correctly choose the better-performing link. To allow existing sessions to fail over, set session-snat-route-change enable must be configured in the system settings.

ZTNA relies on client certificates to cryptographically identify and authenticate the connecting device. If the user's FortiClient does not present a valid certificate that is trusted by the FortiGate ZTNA server, the connection will be denied at the policy level.

ZTNA policies enforce access based on both device identity (certificate) and user identity. If the authenticated user is not part of the user group authorized in the ZTNA policy's source field, the traffic will be denied, resulting in a 'Permission Denied' error.

For a FortiGate automation stitch to react promptly to an event detected on FortiAnalyzer (such as a specific log pattern or IOC), the FortiGate must be configured to upload logs in real-time. If logs are sent in store-and-upload mode, there will be a delay between the event occurrence and its detection on FortiAnalyzer, which would prevent the stitch from executing in a timely manner.