Fortinet NSE8_812 Online Practice Questions and Exam Preparation

Fortinet NSE8_812 Online Questions & Answers

• Question 11:

  A Hub FortiGate is connecting multiple branch FortiGate devices separating the traffic centrally in unique VRFs. Routing information is exchanged using BGP between the Hub and the Branch FortiGate devices.

  You want to efficiently enable route leaking of specific routes between the VRFs.

  Which two steps are required to achieve this requirement? (Choose two.)

  A. Create a vdom link between VRF10 and VRF12
  B. Enable Multi-VDOM mode on the Hub FortiGate and add a VDOM to connect VRF10 and VRF12
  C. Enable BGP recursive routing on the HUB FortiGate
  D. Configure route-maps to leak the selected routes using BGP
  A. Create a vdom link between VRF10 and VRF12
  D. Configure route-maps to leak the selected routes using BGP

• Question 12:

  Refer to the exhibit, which shows a multi-region SD-WAN architecture.

  

  Given this scenario, which two statements are true? (Choose two.)

  A. If iBGP is used, cross-regional spoke-to-hub shortcuts can be established.
  B. If eBGP is used, ADVPN can be established for branch-to-branch traffic across regions.
  C. If eBGP is used, ADVPN can be established only for branch-to-branch traffic within each region.
  D. If iBGP is used, cross-regional spoke-to-hub shortcuts cannot be used.
  C. If eBGP is used, ADVPN can be established only for branch-to-branch traffic within each region.

• Question 13:

  Refer to the exhibits.

  

  

  A customer is looking for a solution to authenticate the clients connected to a hardware switch interface of a FortiGate 400E.

  Referring to the exhibits, which two conditions allow authentication to the client devices before assigning an IP address? (Choose two.)

  A. FortiGate devices with NP6 and hardware switch interfaces cannot support 802.1X authentication.
  B. Devices connected directly to ports 3 and 4 can perform 802 1X authentication.
  C. Ports 3 and 4 can be part of different switch interfaces.
  D. Client devices must have 802 1X authentication enabled
  B. Devices connected directly to ports 3 and 4 can perform 802 1X authentication.
  D. Client devices must have 802 1X authentication enabled

• Question 14:

  A customer would like to improve the performance of a FortiGate VM running in an Azure D4s_v3 instance, but they already purchased a BYOL VM04 license. Which two actions will improve performance the most without making a FortiGate license change? (Choose two.)

  A. Migrate the FortiGate to an Azure F4s_v2.
  B. Enable "Accelerated networking" on the Azure network interfaces.
  C. Enable SR-IOV on the FortiGate.
  D. Migrate the FortiGate to an Azure D8s_v3.
  A. Migrate the FortiGate to an Azure F4s_v2.
  B. Enable "Accelerated networking" on the Azure network interfaces.

• Question 15:

  You want to use the MTA adapter feature on FortiSandbox in an HA-Cluster. Which statement about this solution is true?

  A. The configuration of the MTA Adapter Local Interface is different than on port1.
  B. The MTA adapter is only available in the primary node.
  C. The MTA adapter mode is only detection mode.
  D. The configuration is different than on a standalone device.
  B. The MTA adapter is only available in the primary node.

• Question 16:

  Refer to the exhibit.

  

  A customer has deployed a FortiGate 200F high-availability (HA) cluster that contains and TPM chip. The exhibit shows output from the FortiGate CLI session where the administrator enabled TPM.

  Following these actions, the administrator immediately notices that both FortiGate high availability (HA) status and FortiManager status for the FortiGate are negatively impacted.

  What are the two reasons for this behavior? (Choose two.)

  A. The private-data-encryption key entered on the primary did not match the value that the TPM expected.
  B. Configuration for TPM is not synchronized between FortiGate HA cluster members.
  C. The FortiGate has not finished the auto-update process to synchronize the new configuration to FortiManager yet.
  D. TPM functionality is not yet compatible with FortiGate HA.
  E. The administrator needs to manually enter the hex private data encryption key in FortiManager.
  B. Configuration for TPM is not synchronized between FortiGate HA cluster members.
  E. The administrator needs to manually enter the hex private data encryption key in FortiManager.

• Question 17:

  Review the following FortiGate-6000 configuration excerpt:

  

  Based on the configuration, which statement is correct regarding SNAT source port partitioning behavior?

  A. It dynamically distributes SNAT source ports to operating FPCs or FPMs.
  B. It is the default SNAT configuration and preserves active sessions when an FPC or FPM goes down.
  C. It statically distributes SNAT source ports to operating FPCs or FPMs
  D. It equally distributes SNAT source ports across chassis slots.
  C. It statically distributes SNAT source ports to operating FPCs or FPMs

• Question 18:

  Refer to the exhibit.

  

  The exhibit shows two error messages from a FortiGate root Security Fabric device when you try to configure a new connection to a FortiClient EMS Server. Referring to the exhibit, which two actions will fix these errors? (Choose two.)

  A. Verify that the CRL is accessible from the root FortiGate
  B. Export and import the FortiClient EMS server certificate to the root FortiGate.
  C. Install a new known CA on the Win2K16-EMS server.
  D. Authorize the root FortiGate on the FortiClient EMS
  B. Export and import the FortiClient EMS server certificate to the root FortiGate.
  D. Authorize the root FortiGate on the FortiClient EMS

• Question 19:

  You have configured a Site-to-Site IPsec VPN tunnel between a FortiGate and a third-party device but notice that one of the error counters on the tunnel interface keeps increasing.

  

  Which two configuration options can resolve this problem? (Choose two.)

  A. Enable Forward Error Correction (FEC) on the VPN interface for egress traffic.
  B. Adjust the MTU of the physical interface to which the IPsec tunnel is bound.
  C. Enable DF-bit honoring in the global settings.
  D. Adjust the MTU of the IPsec interface.
  C. Enable DF-bit honoring in the global settings.
  D. Adjust the MTU of the IPsec interface.

• Question 20:

  Refer to the exhibits.

  

  The exhibit shows a FortiGate model device that will be used for zero touch provisioning and a CLI Template.

  

  To facilitate a more efficient roll out of FortiGate devices, you are tasked with using meta fields with the CLI Template to configure the DHCP server on the "office1" FortiGate. Given this scenario, what would be the output of the config ip-range section on the CLI Template?

  

  

  A. Option A
  B. Option B
  C. Option C
  D. Option D
  A. Option A