Fortinet NSE8_812 Online Practice Questions and Exam Preparation

Fortinet NSE8_812 Online Questions & Answers

• Question 71:

  Refer to the exhibit.

  

  You are deploying a FortiGate 6000F. The device should be directly connected to a switch. In the future, a new hardware module providing higher speed will be installed in the switch, and the connection to the FortiGate must be moved to this

  higher-speed port.

  You must ensure that the initial FortiGate interface connected to the switch does not affect any other port when the new module is installed and the new port speed is defined.

  How should the initial connection be made?

  A. Connect the switch on any interface between ports 21 to 24
  B. Connect the switch on any interface between ports 25 to 28
  C. Connect the switch on any interface between ports 1 to 4
  D. Connect the switch on any interface between ports 5 to 8.
  B. Connect the switch on any interface between ports 25 to 28

• Question 72:

  Refer to the exhibit showing a FortiView monitor screen.

  

  After a Secure SD-WAN implementation a customer reports that in FortiAnalyzer under FortiView Secure SD-WAN Monitor there is No Device for selection. What can cause this issue?

  A. Upload option from FortiGate to FortiAnalyzer is not set as a real time.
  B. Extended logging is not enabled on FortiGate.
  C. ADOM 1 is set as a Fabric ADOM.
  D. sla-fail-log-period and sla-pass-log-period on FortiGate health check is not set.
  A. Upload option from FortiGate to FortiAnalyzer is not set as a real time.

• Question 73:

  A remote worker requests access to an SSH server inside the network. You deployed a ZTNA Rule to their FortiClient. You need to follow the security requirements to inspect this traffic. Which two statements are true regarding the requirements? (Choose two.)

  A. FortiGate can perform SSH access proxy host-key validation.
  B. You need to configure a FortiClient SSL-VPN tunnel to inspect the SSH traffic.
  C. SSH traffic is tunneled between the client and the access proxy over HTTPS
  D. Traffic is discarded as ZTNA does not support SSH connection rules
  A. FortiGate can perform SSH access proxy host-key validation.
  C. SSH traffic is tunneled between the client and the access proxy over HTTPS

• Question 74:

  Refer to the exhibit, which shows a FortiGate configuration snippet.

  

  A customer in Costa Rica has a FortiGate with SD-WAN configured to use a VPN connection to the United States to browse the internet using a public IP from that country. They would like to enable the SD-WAN rule using a webhook. Which configuration must be added to the FortiGate, and which type of HTTP request must be used to accomplish this? (Choose two.)

  

  

  A. Option A
  B. Option B
  C. Option C
  D. Option D
  A. Option A
  B. Option B

• Question 75:

  A customer is operating a FortiWeb cluster in a high volume active-active HA group consisting of eight FortiWeb appliances. One of the secondary members is handling traffic for one specific VIP. What will happen with the traffic if that secondary FortiWeb appliance fails?

  A. Traffic will be redirected to the next appliance in the same traffic group.
  B. Traffic will be redistributed by the primary appliance to the remaining secondary appliances.
  C. Traffic will be redistributed by the primary appliance to the remaining secondary appliances that are configured to handle traffic for that specific VIP.
  D. Traffic will be redirected to the secondary member with the least number of sessions.
  A. Traffic will be redirected to the next appliance in the same traffic group.

• Question 76:

  A customer wants to use the FortiAuthenticator REST API to retrieve an SSO group called SalesGroup. The following API call is being made with the 'curl' utility:

  

  Which two statements correctly describe the expected behavior of the FortiAuthenticator REST API? (Choose two.)

  A. Only users with the "Full permission" role can access the REST API
  B. This API call will fail because it requires that API version 2
  C. If the REST API web service access key is lost, it cannot be retrieved and must be changed.
  D. The syntax is incorrect because the API calls needs the get method.
  B. This API call will fail because it requires that API version 2
  D. The syntax is incorrect because the API calls needs the get method.

• Question 77:

  Refer to the exhibit.

  

  What is happening in this scenario?

  A. The user status changed at FortiClient EMS to off-net.
  B. The user is authenticating against a FortiGate Captive Portal.
  C. The user is authenticating against an IdP.
  D. The user has not authenticated on their external browser.
  C. The user is authenticating against an IdP.

• Question 78:

  A FortiGate deployment contains the following configuration:

  

  What is the result of this configuration?

  A. Route-maps are not configurable in VDOM SERVICES
  B. Route-maps from the Root VDOM configuration are available in VDOM SERVICES
  C. Route-maps from VDOM SERVICES are available in all other VDOMs
  D. Route-maps for VDOM SERVICES are excluded from HA configuration synchronization
  D. Route-maps for VDOM SERVICES are excluded from HA configuration synchronization

• Question 79:

  SD-WAN is configured on a FortiGate. You notice that when one of the internet links has high latency the time to resolve names using DNS from FortiGate is very high.

  You must ensure that the FortiGate DNS resolution times are as low as possible with the least amount of work.

  What should you configure?

  A. Configure local out traffic to use the outgoing interface based on SD-WAN rules with a manual defined IP associated to a loopback interface and configure an SD-WAN rule from the loopback to the DNS server.
  B. Configure an SD-WAN rule to the DNS server and use the FortiGate interface IPs in the source address.
  C. Configure two DNS servers and use DNS servers recommended by the two internet providers.
  D. Configure local out traffic to use the outgoing interface based on SD-WAN rules with the interface IP and configure an SD-WAN rule to the DNS server.
  D. Configure local out traffic to use the outgoing interface based on SD-WAN rules with the interface IP and configure an SD-WAN rule to the DNS server.

• Question 80:

  Refer to the exhibits, which show a firewall policy configuration and a network topology.

  

  An administrator has configured an inbound SSL inspection profile on a FortiGate device (FG-1) that is protecting a data center hosting multiple web pages-Given the scenario shown in the exhibits, which certificate will FortiGate use to handle requests to xyz.com?

  A. FortiGate will fall-back to the default Fortinet_CA_SSL certificate.
  B. FortiGate will reject the connection since no certificate is defined.
  C. FortiGate will use the Fortinet_CA_Untrusted certificate for the untrusted connection,
  D. FortiGate will use the first certificate in the server-cert list--the abc.com certificate
  D. FortiGate will use the first certificate in the server-cert list--the abc.com certificate