Fortinet Fortinet Certifications NSE8_812 Questions & Answers

• Question 41:

  Which feature must you enable on the BGP neighbors to accomplish this goal?

  A. Graceful-restart

  B. Deterministic-med

  C. Synchronization

  D. Soft-reconfiguration

  Correct Answer: A

  Explanation: Graceful-restart is a feature that allows BGP neighbors to maintain their routing information during a BGP restart or failover event, without disrupting traffic forwarding or causing route flaps. Graceful-restart works by allowing a BGP speaker (the restarting router) to notify its neighbors (the helper routers) that it is about to restart or failover, and request them to preserve their routing information and forwarding state for a certain period of time (the restart time). The helper routers then mark the routes learned from the restarting router as stale, but keep them in their routing table and continue forwarding traffic based on them until they receive an end-of-RIB marker from the restarting router or until the restart time expires. This way, graceful-restart can minimize traffic disruption and routing instability during a BGP restart or failover event. References:https://docs.fortinet.com/document/fortigate/7.0.0/cookbook/19662/bgp- graceful-restart

• Question 42:

  You are migrating the branches of a customer to FortiGate devices. They require independent routing tables on the LAN side of the network.

  After reviewing the design, you notice the firewall will have many BGP sessions as you have two data centers (DC) and two ISPs per DC while each branch is using at least 10 internal segments.

  Based on this scenario, what would you suggest as the more efficient solution, considering that in the future the number of internal segments, DCs or internet links per DC will increase?

  A. No change in design is needed as even small FortiGate devices have a large memory capacity.

  B. Acquire a FortiGate model with more capacity, considering the next 5 years growth.

  C. Implement network-id, neighbor-group and increase the advertisement-interval

  D. Redesign the SD-WAN deployment to only use a single VPN tunnel and segment traffic using VRFs on BGP

  Correct Answer: D

  Explanation: Using multiple VPN tunnels and BGP sessions for each internal segment is not scalable and efficient, especially when the number of segments, DCs or internet links per DC increases. A better solution is to use a single VPN tunnel per branch and segment traffic using virtual routing and forwarding (VRF) instances on BGP. This way, each VRF can have its own routing table and BGP session, while sharing the same VPN tunnel. References:https:// docs.fortinet.com/document/fortigate/6.4.0/cookbook/103439/sd-wan- with-vrf-and-bgp

• Question 43:

  An administrator has configured a FortiGate device to authenticate SSL VPN users using digital certificates. A FortiAuthenticator is the certificate authority (CA) and the Online Certificate Status Protocol (OCSP) server. Part of the FortiGate configuration is shown below:

  

  Based on this configuration, which two statements are true? (Choose two.)

  A. OCSP checks will always go to the configured FortiAuthenticator

  B. The OCSP check of the certificate can be combined with a certificate revocation list.

  C. OCSP certificate responses are never cached by the FortiGate.

  D. If the OCSP server is unreachable, authentication will succeed if the certificate matches the CA.

  Correct Answer: BD

  B is correct because the OCSP check of the certificate can be combined with a certificate revocation list (CRL). This means that the FortiGate will check the OCSP server to see if the certificate has been revoked, and it will also check the CRL to see if the certificate has been revoked. D is correct because if the OCSP server is unreachable, authentication will succeed if the certificate matches the CA. This is because the FortiGate will fall back to using the CRL if the OCSP server is unreachable. The other options are incorrect. Option A is incorrect because OCSP checks can go to other OCSP servers, not just the FortiAuthenticator. Option C is incorrect because OCSP certificate responses can be cached by the FortiGate. References: Configuring SSL VPN authentication using digital certificates | FortiGate / FortiOS 7.2.0 - Fortinet Document Library Online Certificate Status Protocol (OCSP) | FortiGate / FortiOS 7.2.0 - Fortinet Document Library Certificate Revocation Lists (CRLs) | FortiGate / FortiOS 7.2.0 - Fortinet Document Library

• Question 44:

  Refer to the exhibit.

  

  FortiManager is configured with the Jinja Script under CLI Templates shown in the exhibit.

  Which two statements correctly describe the expected behavior when running this template? (Choose two.)

  A. The Jinja template will automatically map the interface with "WAN" role on the managed FortiGate.

  B. The template will work if you change the variable format to $(WAN).

  C. The template will work if you change the variable format to {{ WAN }}.

  D. The administrator must first manually map the interface for each device with a meta field.

  E. The template will fail because this configuration can only be applied with a CLI or TCL script.

  Correct Answer: DE

  Explanation: D. The administrator must first manually map the interface for each device with a meta field.

  The Jinja template in the exhibit is expecting a meta field calledWANto be set on the managed FortiGate. This meta field will specify which interface on the FortiGate should be assigned the "WAN" role. If the meta field is not set, then the

  template will fail. E. The template will fail because this configuration can only be applied with a CLI or TCL script.

  The Jinja template in the exhibit is trying to configure the interface role on the managed FortiGate. This type of configuration can only be applied with a CLI or TCL script. The Jinja template will fail because it is not a valid CLI or TCL script.

• Question 45:

  You are responsible for recommending an adapter type for NICs on a FortiGate VM that will run on an ESXi Hypervisor. Your recommendation must consider performance as the main concern, cost is not a factor. Which adapter type for the NICs will you recommend?

  A. Native ESXi Networking with E1000

  B. Virtual Function (VF) PCI Passthrough

  C. Native ESXi Networking with VMXNET3

  D. Physical Function (PF) PCI Passthrough

  Correct Answer: C

  Explanation: The FortiGate VM is a virtual firewall appliance that can run on various hypervisors, such as ESXi, Hyper-V, KVM, etc. The adapter type for NICs on a FortiGate VM determines the performance and compatibility of the network interface cards with the hypervisor and the physical network. There are different adapter types available for NICs on a FortiGate VM, such as E1000, VMXNET3, SR-IOV, etc. If performance is the main concern and cost is not a factor, one option is to use native ESXi networking with VMXNET3 adapter type for NICs on a FortiGate VM that will run on an ESXi hypervisor. VMXNET3 is a paravirtualized network interface card that is optimized for performance in virtual machines and supports features such as multiqueue support, Receive Side Scaling (RSS), Large Receive Offload (LRO), IPv6 offloads, and MSI/MSI-X interrupt delivery. Native ESXi networking means that the FortiGate VM uses the standard virtual switch (vSwitch) or distributed virtual switch (dvSwitch) provided by the ESXi hypervisor to connect to the physical network. This option can provide high performance and compatibility for NICs on a FortiGate VM without requiring additional hardware or software components. References: https://docs.fortinet.com/document/fortigate/7.0.0/vm-installation- for-vmware-esxi/19662/installing-fortigate-vm-on-vmware- esxihttps://docs.fortinet.com/document/fortigate/7.0.0/vm-installationfor-vmware- esxi/19662/networking

• Question 46:

  Refer to the CLI output:

  

  Given the information shown in the output, which two statements are correct? (Choose two.)

  A. Geographical IP policies are enabled and evaluated after local techniques.

  B. Attackers can be blocked before they target the servers behind the FortiWeb.

  C. The IP Reputation feature has been manually updated

  D. An IP address that was previously used by an attacker will always be blocked

  E. Reputation from blacklisted IP addresses from DHCP or PPPoE pools can be restored

  Correct Answer: BE

  Explanation: The CLI output shown in the exhibit indicates that FortiWeb has enabled IP Reputation feature with local techniques enabled and geographical IP policies enabled after local techniques (set geoip-policy-order after-local). IP Reputation feature is a feature that allows FortiWeb to block or allow traffic based on the reputation score of IP addresses, which reflects their past malicious activities or behaviors. Local techniques are methods that FortiWeb uses to dynamically update its own blacklist based on its own detection of attacks or violations from IP addresses (such as signature matches, rate limiting, etc.). Geographical IP policies are rules that FortiWeb uses to block or allow traffic based on the geographical location of IP addresses (such as country, region, city, etc.). Therefore, based on the output, one correct statement is that attackers can be blocked before they target the servers behind the FortiWeb. This is because FortiWeb can use IP Reputation feature to block traffic from IP addresses that have a low reputation score or belongto a blacklisted location, which prevents them from reaching the servers and launching attacks. Another correct statement is that reputation from blacklisted IP addresses from DHCP or PPPoE pools can be restored. This is because FortiWeb can use local techniques to remove IP addresses from its own blacklist if they stop sending malicious traffic for a certain period of time (set local-techniques-expire-time), which allows them to regain their reputation and access the servers. This is useful for IP addresses that are dynamically assigned by DHCP or PPPoE and may change frequently. References: https://docs.fortinet.com/document/fortiweb/6.4.0/administration-guide/19662/ip- reputationhttps://docs.fortinet.com/document/fortiweb/6.4.0/administration- guide/19662/geographical-ip-policies

• Question 47:

  Refer to the exhibits, which show a firewall policy configuration and a network topology.

  

  An administrator has configured an inbound SSL inspection profile on a FortiGate device (FG-1) that is protecting a data center hosting multiple web pages-Given the scenario shown in the exhibits, which certificate will FortiGate use to handle requests to xyz.com?

  A. FortiGate will fall-back to the default Fortinet_CA_SSL certificate.

  B. FortiGate will reject the connection since no certificate is defined.

  C. FortiGate will use the Fortinet_CA_Untrusted certificate for the untrusted connection,

  D. FortiGate will use the first certificate in the server-cert list--the abc.com certificate

  Correct Answer: A

  Explanation: When using inbound SSL inspection, FortiGate needs to present a certificate to the client that matches the requested domain name. If no matching certificate is found in the server-cert list, FortiGate will fall-back to the default Fortinet_CA_SSL certificate, which is self-signed and may trigger a warning on the client browser. References:https://docs.fortinet.com/document/fortigate/6.4.0/cookbook/103437/inbound- ssl-inspection

• Question 48:

  Refer to the exhibit.

  

  You are operating an internal network with multiple OSPF routers on the same LAN segment. FGT_3 needs to be added to the OSPF network and has the configuration shown in the exhibit. FGT_3 is not establishing any OSPF connection. What needs to be changed to the configuration to make sure FGT_3 will establish OSPF neighbors without affecting the DR/BDR election?

  

  A. Option A

  B. Option B

  C. Option C

  D. Option D

  Correct Answer: B

  Explanation: The OSPF configuration shown in the exhibit is using the default priority value of 1 for the interface port1. This means that FGT_3 will participate in the DR/BDR election process with the other OSPF routers on the same LAN segment. However, this is not desirable because FGT_3 is a new device that needs to be added to the OSPF network without affecting the existing DR/BDR election. Therefore, to make sure FGT_3 will establish OSPF neighbors without affecting the DR/BDR election, the priority value of the interface port1 should be changed to 0. This will prevent FGT_3 from becoming a DR or BDR and allow it to form OSPF adjacencies with thecurrent DR and BDR. Option B shows the correct configuration that changes the priority value to 0. Option A is incorrect because it does not change the priority value. Option C is incorrect because it changes the network type to point-to-point, which is not suitable for a LAN segment with multiple OSPF routers. Option D is incorrect because it changes the area ID to 0.0.0.1, which does not match the area ID of the other OSPF routers on the same LAN segment. References:https://docs.fortinet.com/document/ fortigate/7.0.0/administration- guide/358640/basic-ospf-example

• Question 49:

  Refer to the exhibit, which shows a VPN topology.

  

  The device IP 10.1.100.40 downloads a file from the FTP server IP 192.168.4.50

  Referring to the exhibit, what will be the traffic flow behavior if ADVPN is configured in this environment?

  A. All the session traffic will pass through the Hub

  B. The TCP port 21 must be allowed on the NAT Device2

  C. ADVPN is not supported when spokes are behind NAT

  D. Spoke1 will establish an ADVPN shortcut to Spoke2

  Correct Answer: D

  Explanation: D is correct because Spoke1 will establish an ADVPN shortcut to Spoke2 when it detects that there is a demand for traffic between them. This is explained in the Fortinet Community article on Technical Tip: Fortinet Auto Discovery VPN (ADVPN) under Summary - ADVPN sequence of events. References:https://community.fortinet.com/t5/FortiGate/Technical-Tip-Fortinet-Auto- Discovery-VPN-ADVPN/ta-p/195698

• Question 50:

  Refer to the exhibits.

  

  An administrator has configured a FortiGate and Forti Authenticator for two-factor authentication with FortiToken push notifications for their SSL VPN login. Upon initial review of the setup, the administrator has discovered that the customers can manually type in their two-factor code and authenticate but push notifications do not work

  Based on the information given in the exhibits, what must be done to fix this?

  A. On FG-1 port1, the ftm access protocol must be enabled.

  B. FAC-1 must have an internet routable IP address for push notifications.

  C. On FG-1 CLI, the ftm-push server setting must point to 100.64.141.

  D. On FAC-1, the FortiToken public IP setting must point to 100.64.1 41

  Correct Answer: B

  Explanation: FortiToken push notifications require that the FortiAuthenticator has an internet routable IP address. This is because the FortiAuthenticator uses this IP address to send push notifications to the FortiGate.

  The other options are not correct. Enabling the ftm access protocol on FG-1 port1 is not necessary for push notifications to work. The ftm-push server setting on FG-1 CLI should already point to the FortiAuthenticator's IP address. The

  FortiToken public IP setting on FAC-1 is not relevant to push notifications.

  Here is a table that summarizes the different options: