Fortinet NSE8_812 Online Practice Questions and Exam Preparation

Fortinet NSE8_812 Online Questions & Answers

• Question 51:

  Refer to the exhibit.

  

  An HTTPS access proxy is configured to demonstrate its function as a reverse proxy on behalf of the web server it is protecting. It verifies user identity, device identity, and trust context, before granting access to the protected source. It is

  assumed that the FortiGate EMS fabric connector has already been successfully connected.

  You need to ensure that ZTNA access through the FortiGate will redirect users to the FortiAuthenticator to perform username/password and multifactor authentication to validate access prior to accessing resources behind the FortiGate.

  In this scenario, which two further steps need to be taken on the FortiGate? (Choose two.)

  A. Create a SAML user/server object referring to the FortiAuthenticator.
  B. Create an authentication rule that sets the sso-auth-method to the FortiAuthenticator.
  C. Create an authentication scheme with the "method" as SAML.
  D. Create a firewall rule that allows access from the remote endpoint to the resources behind the FortiGate.
  A. Create a SAML user/server object referring to the FortiAuthenticator.
  C. Create an authentication scheme with the "method" as SAML.

• Question 52:

  Refer to the exhibits.

  

  A FortiGate cluster (CL-1) protects a data center hosting multiple web applications. A pair of FortiADC devices are already configured for SSL decryption (FAD-1), and re-encryption (FAD-2). CL-1 must accept unencrypted traffic from FAD-1,

  perform application detection on the plain-text traffic, and forward the inspected traffic to FAD-2. The SSL-Offload-App-Detect application list and SSL-Offload protocol options profile are applied to the firewall policy handling the web application traffic on CL-1. Given this scenario, which two configuration tasks must the administrator perform on CL-1? (Choose two.)

  

  A. Option A
  B. Option B
  C. Option C
  D. Option D
  B. Option B
  C. Option C

• Question 53:

  A customer has FortiAP devices in three branch offices managed from a FortiGate in the HQ. Each FortiAP is connected to a dedicated management VLAN.

  The customer wants the users connected to the FortiAP SSIDs to use the branch local internet connection, but each branch uses a different VLAN ID for the bridge. HQ users travel to different branches and connect to the same SSID.

  Which configuration option will solve this requirement?

  A. Set each FortiAP to a wtp-group and use set vlan-pooling wtp-group on the VAP configuration with the corresponding VLAN ID configuration for each group.
  B. Set a FortiAuthenticator for 802.1x authentication with the Tunnel-Type attribute set to VLAN and use set dynamic-vlan enable on the VAP configuration.
  C. Use set vlan-pooling round-robin on the VAP configuration with the corresponding vlan- pool.
  D. Use set vlan-pooling hash on the VAP configuration with the corresponding vlan-pool.
  B. Set a FortiAuthenticator for 802.1x authentication with the Tunnel-Type attribute set to VLAN and use set dynamic-vlan enable on the VAP configuration.

• Question 54:

  Refer to the exhibit containing the configuration snippets from the FortiGate. Customer requirements:

  

  1. SSLVPN Portal must be accessible on standard HTTPS port (TCP/443)

  2. Public IP address (129.11.1.100) is assigned to portl

  3. Datacenter.acmecorp.com resolves to the public IP address assigned to portl

  The customer has a Let's Encrypt certificate that is going to expire soon and it reports that subsequent attempts to renew that certificate are failing.

  Reviewing the requirement and the exhibit, which configuration change below will resolve this issue?

  

  A. Option A
  B. Option B
  C. Option C
  D. Option D
  A. Option A

• Question 55:

  Refer to the exhibit of a FortiNAC configuration.

  

  In this scenario, which two statements are correct? (Choose two.)

  A. A device that is modeled in FortiNAC is connected on VLAN 4093.
  B. An unknown host is connected to port3.
  C. The IP address of the FortiSwitch is 10.12.240.2.
  D. Port8 is connected to a FortiGate in FortiLink mode.
  C. The IP address of the FortiSwitch is 10.12.240.2.
  D. Port8 is connected to a FortiGate in FortiLink mode.

• Question 56:

  Which two statements are correct on a FortiGate using the FortiGuard Outbreak Protection Service (VOS)? (Choose two.)

  A. The FortiGuard VOS can be used only with proxy-base policy inspections.
  B. If third-party AV database returns a match the scanned file is deemed to be malicious.
  C. The antivirus database queries FortiGuard with the hash of a scanned file
  D. The AV engine scan must be enabled to use the FortiGuard VOS feature
  E. The hash signatures are obtained from the FortiGuard Global Threat Intelligence database.
  C. The antivirus database queries FortiGuard with the hash of a scanned file
  E. The hash signatures are obtained from the FortiGuard Global Threat Intelligence database.

• Question 57:

  A customer is planning on moving their secondary data center to a cloud-based laaS. They want to place all the Oracle-based systems Oracle Cloud, while the other systems will be on Microsoft Azure with ExpressRoute service to their main

  data center.

  They have about 200 branches with two internet services as their only WAN connections. As a security consultant you are asked to design an architecture using Fortinet products with security, redundancy and performance as a priority.

  Which two design options are true based on these requirements? (Choose two.)

  A. Systems running on Azure will need to go through the main data center to access the services on Oracle Cloud.
  B. Use FortiGate VM for IPSEC over ExpressRoute, as traffic is not encrypted by Azure.
  C. Branch FortiGate devices must be configured as VPN clients for the branches' internal network to be able to access Oracle services without using public IPs.
  D. Two ExpressRoute services to the main data center are required to implement SD-WAN between a FortiGate VM in Azure and a FortiGate device at the data center edge
  B. Use FortiGate VM for IPSEC over ExpressRoute, as traffic is not encrypted by Azure.
  C. Branch FortiGate devices must be configured as VPN clients for the branches' internal network to be able to access Oracle services without using public IPs.

• Question 58:

  Refer to the exhibit, which shows a VPN topology.

  

  The device IP 10.1.100.40 downloads a file from the FTP server IP 192.168.4.50

  Referring to the exhibit, what will be the traffic flow behavior if ADVPN is configured in this environment?

  A. All the session traffic will pass through the Hub
  B. The TCP port 21 must be allowed on the NAT Device2
  C. ADVPN is not supported when spokes are behind NAT
  D. Spoke1 will establish an ADVPN shortcut to Spoke2
  D. Spoke1 will establish an ADVPN shortcut to Spoke2

• Question 59:

  Refer to the exhibit showing the history logs from a FortiMail device.

  

  Which FortiMail email security feature can an administrator enable to treat these emails as spam?

  A. DKIM validation in a session profile
  B. Sender domain validation in a session profile
  C. Impersonation analysis in an antispam profile
  D. Soft fail SPF validation in an antispam profile
  C. Impersonation analysis in an antispam profile

• Question 60:

  Refer to the exhibits, which show a topology and diagnostic commands.

  

  Which two statements about the path resolution are true? (Choose two.)

  A. Latency is the quality criteria.
  B. wan1 is currently used as an outgoing interface.
  C. wan2 is currently used as an outgoing interface.
  D. Packet-loss is the quality criteria.
  A. Latency is the quality criteria.