Fortinet NSE8_812 Online Practice Questions and Exam Preparation

Fortinet NSE8_812 Online Questions & Answers

• Question 81:

  A retail customer with a FortiADC HA cluster load balancing five webservers in L7 Full NAT mode is receiving reports of users not able to access their website during a sale event. But for clients that were able to connect, the website works

  fine.

  CPU usage on the FortiADC and the web servers is low, application and database servers are still able to handle more traffic, and the bandwidth utilization is under 30%.

  Which two options can resolve this situation? (Choose two.)

  A. Change the persistence rule to LB_PERSIS_SSL_SESSJD.
  B. Add more web servers to the real server poof
  C. Disable SSL between the FortiADC and the web servers
  D. Add a connection-pool to the FortiADC virtual server
  A. Change the persistence rule to LB_PERSIS_SSL_SESSJD.
  D. Add a connection-pool to the FortiADC virtual server

• Question 82:

  Refer to the exhibit, which shows an SD-WAN configuration.

  

  You configured the SD-WAN from Branch1 to the HUB and enabled packet duplication. You later notice that the traffic is not being duplicated. In this scenario, what is causing this problem?

  A. There is a mismatch in the FortiOS version between Branch1 and HUB.
  B. Traffic cannot be duplicated over multiple zones.
  C. Packet duplication is not enabled on the HUB side.
  D. Packet duplication did not occur because an interface is out of SLA.
  B. Traffic cannot be duplicated over multiple zones.

• Question 83:

  An HA topology is using the following configuration:

  

  Based on this configuration, how long will it take for a failover to be detected by the secondary cluster member?

  A. 600ms
  B. 200ms
  C. 300ms
  D. 100ms
  A. 600ms

• Question 84:

  Refer to The exhibit showing a FortiEDR configuration.

  

  Based on the exhibit, which statement is correct?

  A. The presence of a cryptolocker malware at rest on the filesystem will be detected by the Ransomware Prevention security policy.
  B. FortiEDR Collector will not collect OS Metadata.
  C. If a malicious file is executed and attempts to establish a connection it will generate duplicate events.
  D. If an unresolved file rule is triggered, by default the file is logged but not blocked.
  D. If an unresolved file rule is triggered, by default the file is logged but not blocked.

• Question 85:

  Refer to the CLI output:

  

  Given the information shown in the output, which two statements are correct? (Choose two.)

  A. Geographical IP policies are enabled and evaluated after local techniques.
  B. Attackers can be blocked before they target the servers behind the FortiWeb.
  C. The IP Reputation feature has been manually updated
  D. An IP address that was previously used by an attacker will always be blocked
  E. Reputation from blacklisted IP addresses from DHCP or PPPoE pools can be restored
  B. Attackers can be blocked before they target the servers behind the FortiWeb.
  E. Reputation from blacklisted IP addresses from DHCP or PPPoE pools can be restored

• Question 86:

  An administrator has configured a FortiGate device to authenticate SSL VPN users using digital certificates. A FortiAuthenticator is the certificate authority (CA) and the Online Certificate Status Protocol (OCSP) server. Part of the FortiGate configuration is shown below:

  

  Based on this configuration, which two statements are true? (Choose two.)

  A. OCSP checks will always go to the configured FortiAuthenticator
  B. The OCSP check of the certificate can be combined with a certificate revocation list.
  C. OCSP certificate responses are never cached by the FortiGate.
  D. If the OCSP server is unreachable, authentication will succeed if the certificate matches the CA.
  A. OCSP checks will always go to the configured FortiAuthenticator
  B. The OCSP check of the certificate can be combined with a certificate revocation list.

• Question 87:

  You are migrating the branches of a customer to FortiGate devices. They require independent routing tables on the LAN side of the network.

  After reviewing the design, you notice the firewall will have many BGP sessions as you have two data centers (DC) and two ISPs per DC while each branch is using at least 10 internal segments.

  Based on this scenario, what would you suggest as the more efficient solution, considering that in the future the number of internal segments, DCs or internet links per DC will increase?

  A. No change in design is needed as even small FortiGate devices have a large memory capacity.
  B. Acquire a FortiGate model with more capacity, considering the next 5 years growth.
  C. Implement network-id, neighbor-group and increase the advertisement-interval
  D. Redesign the SD-WAN deployment to only use a single VPN tunnel and segment traffic using VRFs on BGP
  D. Redesign the SD-WAN deployment to only use a single VPN tunnel and segment traffic using VRFs on BGP

• Question 88:

  Refer to the exhibit.

  

  The exhibit shows the topology a customer wants to implement using a flexible authentication scheme. Users connecting from trusted remote locations are authenticated using only their username/password when connecting to the SSLVPN FortiGate in the data center.

  When connecting from the Untrusted Clients, users must authenticate using 2-factor authentication.

  In this scenario, which RADIUS attribute can be used as a RADIUS policy selector on the FortiAuthenticator to accomplish this goal?

  A. Calling-Station-Id
  B. Framed-IP-Address
  C. Tunnel-Client-Auth-Id
  D. Login-IP-Host
  C. Tunnel-Client-Auth-Id

• Question 89:

  Refer to the exhibit.

  

  A customer wants to automate the creation and configuration of FortiGate VM instances in a VMware vCenter environment using Terraform. They have the creation part working with the code shown in the exhibit. Which code snippet will allow Terraform to automatically connect to a newly deployed FortiGate if its IP was dynamically assigned by VMware NSX-T?

  

  A. Option A
  B. Option B
  C. Option C
  D. Option D
  A. Option A

• Question 90:

  Refer to the exhibit.

  

  A customer has deployed a FortiGate 300E with virtual domains (VDOMs) enabled in the multi-VDOM mode. There are three VDOMs: Root is for management and internet access, while VDOM 1 and VDOM 2 are used for segregating internal traffic. AccountVInk and SalesVInk are standard VDOM links in Ethernet mode.

  Given the exhibit, which two statements below about VDOM behavior are correct? (Choose two.)

  A. You can apply OSPF routing on the VDOM link in either PPP or Ethernet mode
  B. Traffic on AccountVInk and SalesVInk will not be accelerated.
  C. The VDOM links are in Ethernet mode because they have IP addressed assigned on both sides.
  D. Root VDOM is an Admin type VDOM, while VDOM 1 and VDOM 2 are Traffic type VDOMs.
  E. OSPF routing can be configured between VDOM 1 and Root VDOM without any configuration changes to AccountVInk
  A. You can apply OSPF routing on the VDOM link in either PPP or Ethernet mode
  B. Traffic on AccountVInk and SalesVInk will not be accelerated.