Exam NSE8_812 topic 1 question 109 discussion

Actual exam question from Fortinet's NSE8_812

Question #: 109
Topic #: 1

Refer to the exhibits, which show a network topology and VPN configuration.

A network administrator has been tasked with modifying the existing dial-up IPsec VPN infrastructure to detect the path quality to the remote endpoints.

After applying the configuration shown in the configuration exhibit, the VPN clients can still connect and access the protected 172.16.205.0/24 network, but no SLA information shows up for the client tunnels when issuing the diagnose sys link-monitor tunnel all command on the FortiGate CLI.

What is wrong with the configuration?

A. SLA link monitoring does not work with the net-device setting.
B. The admin needs to disable the mode-cfg setting.
C. IPsec Phase1 Interface has to be configured in IPsec main mode.
D. It is necessary to use the IKEv2 protocol in this situation.

Show Suggested Answer

Suggested Answer: A 🗳️

by theklee at Aug. 11, 2025, 6:57 p.m.

Comments

Submit Cancel

theklee

1 week, 2 days ago

Selected Answer: A

I think the answer is supposed to be A and the exhibit is supposed to say set net-device enable (it only works with set net-device disable) https://docs.fortinet.com/document/fortigate/7.6.3/administration-guide/50631/sla-link-monitoring-for-dynamic-ipsec-and-ssl-vpn-tunnels B - mode-cfg enable is supported C - Aggressive IKEv1 is supported D - Not required as it's using aggressive mode

upvoted 1 times

...