Fortinet Network Security Expert 8 Written (800): What Candidates Need to Know Before Preparing
The Fortinet NSE 8 Written (800) is not the current route to initial NSE 8 certification. Fortinet states that the NSE8_812 written exam was discontinued as a prerequisite for initial certification and recertification, while the current NSE 8 pathway uses the Core Practical exam and one Elective Practical exam. This guide helps experienced Fortinet professionals decide whether they are researching a historical written exam, preparing for the current practical route, or checking an existing booking and should therefore confirm the applicable exam status before buying study material or scheduling.
Is the NSE 8 Written (800) still the correct exam?
No. Fortinet states that the NSE8_812 written exam is discontinued as a prerequisite for both initial NSE 8 certification and recertification. It also does not replace the NSE 4, NSE 5 or NSE 6, and NSE 7 prerequisite certifications because it does not align with the updated practical exams.
The number 800 can create confusion because Fortinet’s current NSE 8 Core exam is also identified as the 880 - Core exam. The current 880 exam is a practical assessment, not the former written NSE8_812 assessment. A search result, marketplace listing, or third-party page that calls the 800 a current NSE 8 written prerequisite may be describing an older program state.
Treat the distinction as a scheduling decision, not a wording detail. If your objective is initial NSE 8 certification, check the current NSE 8 certification requirements and the 880 Core exam page first. If you already hold an older voucher or have an existing registration, contact Fortinet Training Institute or the applicable testing provider before assuming that the voucher can be used for a current practical exam.
What does the current NSE 8 certification validate?
The NSE 8 Cybersecurity Expert designation recognizes comprehensive knowledge of network-security design, configuration, and troubleshooting in complex networks. Fortinet recommends it for networking and security experts who use Fortinet solutions and have experience solving complicated security problems across varied complex networks.
This is broader than remembering individual FortiGate commands. The current Core Practical exam evaluates whether a candidate can make sound design decisions, implement a multi-product security solution, and troubleshoot the result. The expected capability is closer to diagnosing an integrated production architecture than completing an isolated product administration exercise.
The certification is not awarded by passing the Core exam alone. Under Fortinet’s stated program requirements, a candidate must meet the prerequisite certifications, pass the NSE 8 Core Practical exam, and pass one NSE 8 Elective Practical exam within 1 year of passing the Core exam. The Core must be passed before the Elective can be taken for this pathway.
Who should prepare for this level?
The intended audience is networking and security experts who use Fortinet solutions and already have industry experience with complex networks. A candidate who has only studied entry-level interface workflows should strengthen operational experience before attempting the NSE 8 assessment.
Fortinet lists active prerequisite certifications for scheduling the Core exam: NSE 4, NSE 5 or NSE 6 from any of the four NSE certification tracks, and NSE 7 on the same track as the NSE 5 or NSE 6 certification. These are official eligibility requirements, not merely recommended background knowledge.
The track relationship matters. Holding an NSE 5 or NSE 6 in one track and an NSE 7 in another does not satisfy the stated same-track condition. Review the active status and track of each certificate in the Fortinet Training Institute account before planning a date.
Practical readiness is a separate question from eligibility. You may be allowed to schedule an exam and still lack the ability to trace an asymmetric route, explain a policy interaction, isolate an authentication failure, or recover a misconfiguration without guessing. Use recent work, controlled lab exercises, and troubleshooting records to assess readiness.
What products and skills are assessed in the Core exam?
The current Core Practical exam lists FortiGate 7.6, FortiManager 7.6, FortiAnalyzer 7.6, and FortiAuthenticator 8.0 as the products used. Fortinet describes the assessed work as design, configuration, and troubleshooting tasks across complex networks.
The published exam topics include infrastructure, networking, authentication, and additional product and security capabilities. The product versions are important when choosing documentation: build your study notes around the versions identified by the current exam page rather than mixing commands and behavior from unrelated releases.
Infrastructure represents 27% of the exam domain named Infrastructure. Its listed areas include high availability, LACP, FGCP, FGSP, FortiAnalyzer HA, FortiAuthenticator HA, FortiManager HA, virtual clustering, VRRP architecture, multi-data-center deployments, redundant connectivity, FortiGate-VM bootstrapping, firmware management, FortiGuard, policy packages, log management, multi-tenancy, VDOMs, operation modes, and VM deployments.
Networking represents 40% of the exam domain named Networking. The published topics include SASE, Secure Private Access preparation, SD-WAN on-ramp, asymmetric routing, BFD, dynamic routing, ECMP, multicast, policy routing, SD-WAN routing, static routing, VRF, ADVPN, dial-up VPN, IPsec VPN, overlay VPN, PQC for IPsec key exchange, SD-WAN, SSL VPN, VXLAN over IPsec, ZTNA, NGFW integrations, inspection modes, IPv6, policy modes, proxy rules, security profiles, DLP, web filtering, SSL inspection, IPS, transparent mode, explicit proxy, inter-VDOM routing, local-in policies, local-out routing, NAT, traffic shaping, VLANs, and zones.
Authentication represents 14% of the exam domain named Authentication. Its listed areas include 802.1X, ADOM-scoped administrators, advanced authentication, API authentication, captive portal, device and user authentication, Fabric SSO, FSSO, IAM, LDAP, OAuth, RADIUS, RSSO, SAML, and SNMPv3.
Do not turn these percentages into a complete prediction of the exam. The supplied official material identifies these domain weights, but the available excerpt does not provide every domain and task detail. Study every published topic and avoid assuming that a smaller-looking area is safe to ignore.
How is the current Core assessment delivered?
Fortinet currently lists the NSE 8 Core exam as onsite at selected Fortinet offices and events, in English, with the number of tasks and appointment time communicated per exam. The listed cost is US$800 per exam. Confirm these details on the official exam page before making travel or budget commitments because delivery arrangements and fees can change.
The current Core task types are hands-on configuration, troubleshooting, drag and drop, and multiple choice. Fortinet lists partial credit for selected tasks and says there are no deductions for incorrect answers. The result is pass or fail, and Fortinet states that acknowledgment and training transcripts are updated with the exam grade within 30 days.
Fortinet also states that the time required between unsuccessful attempts is 30 days. This makes a rushed first attempt a poor substitute for a readiness check. Build a recovery plan before scheduling: identify weak domains, reserve time for a second study cycle, and verify the retake policy on the current page.
The historical written-exam booking article says that technical NSE certification written exams from NSE 4 to 8 were delivered at Pearson VUE testing centers or remotely through OnVUE online proctoring. That information describes the former written-exam process and should not be used to infer that the current 880 Core exam is remote or Pearson VUE delivered. The current Core page and certification requirements state that the Core is onsite at selected Fortinet offices and events.
What must be completed before scheduling?
First verify the three active prerequisite categories: NSE 4 FortiOS certification, NSE 5 or NSE 6 certification in any track, and NSE 7 certification on the same track as the NSE 5 or NSE 6 certification. Then confirm that the intended Core exam is the current practical assessment rather than a reference to the discontinued NSE8_812 written exam.
Fortinet notes that candidates may be asked to provide additional information before scheduling the Core Practical exam. The request may concern account information, training and testing history, or prior engagement with Fortinet and the NSE Certification Program. A candidate may be unable to proceed if the requested information is not satisfactorily provided.
A sensible pre-booking checklist is short but consequential: review certificate names and active status, confirm the NSE 5 or NSE 6 and NSE 7 track relationship, check the official Core delivery location, confirm the language and current fee, and review whether your planned Elective is available in the required time window.
Do not purchase a written-exam voucher based on an old page title. Fortinet’s written-exam booking instructions explain how Pearson VUE vouchers were obtained and redeemed, but the NSE8_812 written exam is explicitly discontinued as a certification prerequisite. Resolve voucher applicability directly with Fortinet before payment.
Which study resources should replace a written-exam study guide?
Fortinet says there is no dedicated study guide for the current NSE 8 practical exams. Its recommended preparation path uses the NSE 8 Public Handbook, product administration guides, NSE training, and course material. That means preparation should be organized around tasks and troubleshooting outcomes rather than a list of written questions.
Start with the exam preparation section in the NSE 8 Public Handbook and the current 880 Core exam page. Use the published product versions to select relevant documentation. Then create a matrix with one row for each topic: design decision, configuration workflow, verification command or view, common failure symptom, and evidence that confirms the fix.
Fortinet’s Training Institute library is useful for filling product gaps. Available course descriptions include subjects such as firewall policies, user authentication, high availability, SSL VPN, site-to-site IPsec VPN, Security Fabric, IPS, antivirus, web filtering, application control, FortiGate in Cloud, FortiSASE, logging, and monitoring. Select current courses and check for labels indicating that a course is an older version before relying on it for version-specific behavior.
Fortinet also provides an NSE 8 Written Sample Questions 7.x course in its library. Because the NSE8_812 written exam is discontinued and the current assessment is practical, treat that material as historical written-exam orientation rather than as a substitute for Core Practical preparation. It may help reveal terminology, but it cannot demonstrate the configuration and troubleshooting ability required by the current format.
How should a lab environment be used?
Use a lab to reproduce decisions and failure conditions, not to copy a sequence of clicks. Fortinet says there is no remote lab available for the FCX practical exam, but candidates can use Fortinet VMs to create an environment for testing configurations and exploring solutions included in the exam.
Build the smallest topology that lets you test dependencies across FortiGate, FortiManager, FortiAnalyzer, and FortiAuthenticator. Add redundancy, routing changes, identity services, logging, and security inspection progressively. The goal is not to recreate an undisclosed exam environment; it is to make each configuration choice observable and reversible.
For every lab exercise, record five things: the intended traffic or identity flow, the components involved, the configuration applied, the verification evidence, and the first diagnostic step when it fails. For example, a VPN exercise should include route selection, phase negotiation, selectors, policy treatment, and the log or status output that separates a negotiation failure from a policy failure.
Deliberately break one dependency at a time. Remove a route, alter an authentication attribute, change an inspection setting, stop log forwarding, or introduce an HA mismatch. Then troubleshoot from symptoms to evidence. This is more valuable than repeating a successful build because the current exam explicitly assesses troubleshooting as well as configuration.
How should the exam domains shape the study sequence?
Begin with networking because the official blueprint assigns 40% of the exam domain named Networking and because routing, VPN, inspection, and policy behavior often connect several products. Follow with infrastructure at 27% of the exam domain named Infrastructure, then authentication at 14% of the exam domain named Authentication. Continue through every remaining published topic rather than stopping after these three domains.
A productive sequence is dependency-first. Establish routing, interfaces, VLANs, zones, NAT, and policy behavior before adding SD-WAN, VPN overlays, proxy functions, and security profiles. Add HA and centralized management after the base traffic path is clear. Introduce authentication and logging once you can distinguish a network failure from an identity or telemetry failure.
For networking, practice explaining why a route was selected, how asymmetric traffic is handled, how an overlay changes forwarding, and how inspection mode affects the path. Include IPv6, VRF, ECMP, multicast, policy routing, SD-WAN, ADVPN, IPsec, SSL VPN, VXLAN over IPsec, ZTNA, and security profiles in your review because they appear in the official topic list.
For infrastructure, compare the operational consequences of HA mechanisms, centralized policy management, VDOM and multi-tenancy choices, VM bootstrapping, firmware management, and log-management design. For authentication, test LDAP, RADIUS, SAML, OAuth, FSSO, RSSO, captive portal, API authentication, and administrative scoping as distinct flows. Do not treat all identity integrations as interchangeable.
A practical study roadmap
A useful roadmap has four passes: eligibility and scope, product consolidation, fault-based lab work, and assessment rehearsal. Do not assign a fixed number of weeks without accounting for your existing Fortinet experience; the right pace depends on whether the topics are daily work or unfamiliar products.
Pass one: confirm the route. Verify the active prerequisites, read the current Core page, identify the current product versions, and choose the Elective direction that matches your professional objectives. Remove NSE8_812 written-exam material from the center of the plan. Keep only historical material that helps clarify terminology or identify knowledge gaps.
Pass two: consolidate product fundamentals. Work through current Fortinet training and administration documentation for the products listed in the Core exam. For each feature, write a short explanation of its purpose, prerequisites, configuration location, verification method, and failure symptoms. Avoid collecting isolated commands without recording the design reason behind them.
Pass three: run fault-based labs. Build integrated scenarios that combine routing, policy, authentication, HA, management, logging, and security inspection. Break the scenarios intentionally and troubleshoot without immediately consulting the answer. When you need documentation, record what search term found the answer and why the first diagnosis was wrong.
Pass four: rehearse the task styles. Alternate hands-on builds, troubleshooting tickets, drag-and-drop relationship exercises, and multiple-choice design decisions. For a multiple-choice item, identify the stated requirement, eliminate options that violate the topology, and choose the remaining option based on product behavior rather than wording familiarity. For a hands-on task, verify the result from the traffic, device, and log perspectives.
Finish with a gap review based on evidence. A topic is not ready merely because you recognize its name. Mark it ready only when you can design a solution, configure it, verify it, and explain how you would isolate a failure. Reserve a separate review for topics that involve version-sensitive behavior or several interacting products.
How can you use sample questions without overrelying on them?
Fortinet provides a set of sample questions through the Training Institute. Use them to understand the style of reasoning and to expose terminology gaps, not to predict live content or replace lab practice.
After each sample question, write the reason the correct option fits and the reason each alternative fails. Then reproduce the underlying concept in a lab or configuration diagram. If a question concerns routing, test route selection and failover. If it concerns authentication, trace the identity source, exchange, authorization decision, and resulting policy behavior.
Do not use exam dumps, leaked questions, or memorization services as a preparation strategy. They cannot establish that you can configure and troubleshoot a complex Fortinet environment, and reliance on unauthorized material creates a poor basis for deciding whether you are ready. Official sample questions and documented product behavior are safer foundations.
What mistakes commonly waste preparation time?
The most damaging mistake is preparing for the discontinued NSE8_812 written exam as though it were the current certification gate. The next is studying product features separately without testing how routing, identity, policy, HA, management, and logging interact. A third is booking before confirming prerequisites, delivery location, and current program requirements.
Another common error is treating the published domain percentages as permission to ignore the rest of the blueprint. Networking represents 40% of the exam domain named Networking, Infrastructure represents 27% of the exam domain named Infrastructure, and Authentication represents 14% of the exam domain named Authentication; these labels must remain attached to the percentages, and the figures do not describe every topic in the assessment.
Candidates also lose efficiency by reading documentation passively. Convert each major topic into an action: draw the traffic path, configure it, verify it, break it, and restore it. Keep version notes so that an older course or administration guide is not silently mixed with the current product versions.
Finally, do not confuse a passed Core exam with the completed NSE 8 certification. Fortinet requires the Core Practical exam and one Elective Practical exam within 1 year, with the Core first. Schedule the Elective plan early enough to account for availability, preparation, and the possibility of a retake.
What happens after passing or failing?
The current Core exam uses pass-or-fail scoring, with partial credit available for selected tasks and no deductions for incorrect answers. Fortinet states that the exam grade is acknowledged and training transcripts are updated within 30 days. A Core pass is an important milestone, but the NSE 8 certification still requires the prerequisite certifications and one Elective Practical pass within 1 year.
If you fail, Fortinet lists 30 days as the required interval between unsuccessful attempts. Use that interval for targeted remediation rather than repeating the same notes. Compare your lab records against the official topic list, identify the failure pattern, and rebuild the weakest integrated scenario before attempting another date.
Fortinet states that the NSE 8 certification is active for 2 years from the date of the second exam. For renewal, the official certification page lists active prerequisite certifications and accumulation of 200 activity points. It also describes an NSE 8 Recertification Exam route for eligible candidates whose certificate expiry date is before July 31, 2027, with that recertification exam available until January 31, 2027. Because renewal rules are time-sensitive, confirm the current eligibility conditions before relying on either route.
What should you do now?
Start by deciding which problem you are solving: researching an old NSE 8 Written (800) listing, scheduling the current 880 Core Practical exam, or planning the complete NSE 8 certification. That decision determines which official page, delivery model, prerequisites, and preparation resources apply.
For a current certification attempt, verify the active NSE 4, NSE 5 or NSE 6, and same-track NSE 7 prerequisites. Read the current Core blueprint, select version-aligned training and administration documentation, build an integrated lab plan, and choose an Elective that fits your experience. Do not schedule until you can demonstrate both configuration and fault isolation across the listed products.
For an old voucher or written-exam registration, pause payment and preparation based on third-party claims. The official requirement page says NSE8_812 is discontinued as a prerequisite. Confirm the voucher or registration position with Fortinet Training Institute, then move to the current 880 Core information if initial certification is your goal.
Conclusion
The NSE 8 Written (800) should not be treated as the current certification prerequisite. Fortinet’s current path is built around the 880 Core Practical exam, an Elective Practical exam, active prerequisite certifications, and demonstrated ability to design, configure, and troubleshoot complex Fortinet networks. The most useful next step is to verify your certification route and account status, then prepare against the current official blueprint with version-aligned documentation and fault-based lab work rather than relying on historical written-exam listings or memorized questions.
Related exams
- FCP_FAC_AD-6.5 exam — FCPFortiAuthenticator 6.5 Administrator
- FCP_FCT_AD-7.4 exam — Fortinet NSE 6FortiClient EMS 7.4 Administrator
- FCP_FGT_AD-7.4 exam — FCP - FortiGate 7.4 Administrator
- FCP_FWF_AD-7.4 exam — FCPSecure Wireless LAN 7.4 Administrator
- NSE4_FGT_AD-7.6 exam — Fortinet NSE 4FortiOS 7.6 Administrator
- NSE5_FNC_AD_7.6 exam — Fortinet NSE 5FortiNAC-F 7.6 Administrator
