Fortinet NSE8_812 Online Practice Questions and Exam Preparation

Fortinet NSE8_812 Online Questions & Answers

• Question 41:

  Refer to the exhibit.

  

  You need to create a base SD-WAN configuration that includes SD-WAN rules and Performance SLAs for spoke sites with various connectivity types. It needs to be done in a way that can be easily applied to new sites with a minimum amount of change. How should you create the SD-WAN zones?

  A. With members and assign overlay interfaces
  B. With members without interface assignments
  C. With no members configured
  D. With members and assign interfaces but do not specify a gateway
  A. With members and assign overlay interfaces

• Question 42:

  Which feature must you enable on the BGP neighbors to accomplish this goal?

  A. Graceful-restart
  B. Deterministic-med
  C. Synchronization
  D. Soft-reconfiguration
  A. Graceful-restart

• Question 43:

  What is the benefit of using FortiGate NAC LAN Segments?

  A. It provides support for multiple DHCP servers within the same VLAN.
  B. It provides physical isolation without changing the IP address of hosts.
  C. It provides support for IGMP snooping between hosts within the same VLAN
  D. It allows for assignment of dynamic address objects matching NAC policy.
  B. It provides physical isolation without changing the IP address of hosts.

• Question 44:

  You deployed a fully loaded FG-7121F in the data center and enabled sslvpn-load-balance. Based on the behavior of this feature which statement is correct?

  A. You can use src-ip or dst-ip-dport on dp-load-distribution-method to make SSL VPN load balancing work as expected.
  B. If an FPM goes down, SSL VPN IP pool IP addresses will be re-allocated to the remaining FPMs.
  C. To have better traffic distribution you should use IP pools that increment in multiples of 12.
  D. Enabling SSL VPN load balancing will clear the session table.
  A. You can use src-ip or dst-ip-dport on dp-load-distribution-method to make SSL VPN load balancing work as expected.

• Question 45:

  Refer to the exhibits.

  

  The exhibits show a FortiMail network topology, Inbound configuration settings, and a Dictionary Profile.

  You are required to integrate a third-party's host service (srv.thirdparty.com) into the e-mail processing path.

  All inbound e-mails must be processed by FortiMail antispam and antivirus with FortiSandbox integration. If the email is clean, FortiMail must forward it to the third-party service, which will send the email back to FortiMail for final delivery,

  FortiMail must not scan the e-mail again.

  Which three configuration tasks must be performed to meet these requirements? (Choose three.)

  A. Change the scan order in FML-GW to antispam-sandbox-content.
  B. Apply the Catch-Ail profile to the CFInbound profile and configure a content action profile to deliver to the srv. thirdparty. com FQDN
  C. Create an access receive rule with a Sender value of srv. thirdparcy.com, Recipient value of *@acme.com, and action value of Safe
  D. Apply the Catch-AII profile to the ASinbound profile and configure an access delivery rule to deliver to the 100.64.0.72 host.
  E. Create an IP policy with a Source value of 100. 64 .0.72/32, enable precedence, and place the policy at the top of the list.
  A. Change the scan order in FML-GW to antispam-sandbox-content.
  B. Apply the Catch-Ail profile to the CFInbound profile and configure a content action profile to deliver to the srv. thirdparty. com FQDN
  E. Create an IP policy with a Source value of 100. 64 .0.72/32, enable precedence, and place the policy at the top of the list.

• Question 46:

  Refer to the exhibit showing FortiGate configurations

  

  FortiManager VM high availability (HA) is not functioning as expected after being added to an existing deployment.

  The administrator finds that VRRP HA mode is selected, but primary and secondary roles are greyed out in the GUI The managed devices never show online when FMG-B becomes primary, but they will show online whenever the FMG-A

  becomes primary.

  What change will correct HA functionality in this scenario?

  A. Change the FortiManager IP address on the managed FortiGate to 10.3.106.65.
  B. Make the monitored IP to match on both FortiManager devices.
  C. Unset the primary and secondary roles in the FortiManager CLI configuration so VRRP will decide who is primary.
  D. Change the priority of FMG-A to be numerically lower for higher preference
  A. Change the FortiManager IP address on the managed FortiGate to 10.3.106.65.

• Question 47:

  A FortiGate running FortiOS 7.2.0 GA is configured in multi-vdom mode with a vdom set to vdom type Admin and another vdom set to vdom type Traffic. Which two GUI sections are available on both VDOM types? (Choose two.)

  A. Interface configuration
  B. Packet capture
  C. Security Fabric topology and external connectors
  D. Certificates
  E. FortiClient configuration
  A. Interface configuration
  B. Packet capture

• Question 48:

  You are running a diagnose command continuously as traffic flows through a platform with NP6 and you obtain the following output:

  

  Given the information shown in the output, which two statements are true? (Choose two.)

  A. Enabling bandwidth control between the ISF and the NP will change the output
  B. The output is showing a packet descriptor queue accumulated counter
  C. Enable HPE shaper for the NP6 will change the output
  D. Host-shortcut mode is enabled.
  E. There are packet drops at the XAUI.
  B. The output is showing a packet descriptor queue accumulated counter
  E. There are packet drops at the XAUI.

• Question 49:

  Refer to the exhibits.

  

  A customer has deployed a FortiGate with iBGP and eBGP routing enabled. HQ is receiving routes over eBGP from ISP 2; however, only certain routes are showing up in the routing table-Assume that BGP is working perfectly and that the only possible modifications to the routing table are solely due to the prefix list that is applied on HQ.

  Given the exhibits, which two routes will be active in the routing table on the HQ firewall? (Choose two.)

  A. 172.16.204.128/25
  B. 172.16.201.96/29
  C. 172,620,64,27
  D. 172.16.204.64/27
  A. 172.16.204.128/25
  D. 172.16.204.64/27

• Question 50:

  Refer to the exhibits, which show a network topology and VPN configuration.

  

  A network administrator has been tasked with modifying the existing dial-up IPsec VPN infrastructure to detect the path quality to the remote endpoints.

  After applying the configuration shown in the configuration exhibit, the VPN clients can still connect and access the protected 172.16.205.0/24 network, but no SLA information shows up for the client tunnels when issuing the diagnose sys link-

  monitor tunnel all command on the FortiGate CLI.

  What is wrong with the configuration?

  A. SLA link monitoring does not work with the net-device setting.
  B. The admin needs to disable the mode-cfg setting.
  C. IPsec Phase1 Interface has to be configured in IPsec main mode.
  D. It is necessary to use the IKEv2 protocol in this situation.
  A. SLA link monitoring does not work with the net-device setting.