Refer to the exhibit, which shows a multi-region SD-WAN architecture. Given this scenario, which two statements are true? (Choose two.)

If eBGP is used, ADVPN can be established only for branch-to-branch traffic within each region.

If iBGP is used, cross-regional spoke-to-hub shortcuts can be established.

If eBGP is used, ADVPN can be established for branch-to-branch traffic across regions.

If eBGP is used, ADVPN can be established only for branch-to-branch traffic within each region.

If iBGP is used, cross-regional spoke-to-hub shortcuts cannot be used.

Refer to The exhibit, which shows a topology diagram. A customer wants to use SD-WAN for traffic generated from the data center towards Branches. SD-WAN on HUB should follow the underlay condition on each Branch and the solution should be scalable for hundreds of Branches.Which SD WAN-Rules strategy should be used?

Best Quality based on route-tags

Refer to the exhibits, which show a topology and diagnostic commands. Which two statements about the path resolution are true? (Choose two.)

Latency is the quality criteria.

wan1 is currently used as an outgoing interface.

wan2 is currently used as an outgoing interface.

Packet-loss is the quality criteria.

Which two statements about bounce address tagging and verification (BATV) on FortiMail are true? (Choose two.)

Emails with an empty sender address will be subjected to bounce verification.

FortiMail will insert the BATV tag to the sender address in the envelope.

You must publish the BATV public key as a DNS TXT record.

Emails with an empty sender address will be subjected to bounce verification.

FortiMail will insert the BATV tag to the sender address in the envelope.

BATV will use symmetric keys to verify the bounce address tag.

Refer to the exhibit, which shows an SD-WAN configuration. You configured the SD-WAN from Branch1 to the HUB and enabled packet duplication. You later notice that the traffic is not being duplicated. In this scenario, what is causing this problem?

Traffic cannot be duplicated over multiple zones.

There is a mismatch in the FortiOS version between Branch1 and HUB.

Traffic cannot be duplicated over multiple zones.

Packet duplication is not enabled on the HUB side.

Packet duplication did not occur because an interface is out of SLA.

Refer to the exhibit, which shows diagnostic output. A customer reports that ICMP traffic flow from 192.168.1.11 to 93.190.134.171 is not corresponding to the SD-WAN setup.What is the problem in this scenario?

Traffic is matched by policy route.

SD-WAN Rule is matching only DNS traffic.

Port1 is used because it has more available bandwidth.

Traffic is matched by policy route.

Route for the destination IP is missing in the routing table.

Refer to the exhibit. What is happening in this scenario?

The user is authenticating against an IdP.

The user status changed at FortiClient EMS to off-net.

The user is authenticating against a FortiGate Captive Portal.

The user is authenticating against an IdP.

The user has not authenticated on their external browser.

A FortiGate running FortiOS 7.2.0 GA is configured in multi-vdom mode with a vdom set to vdom type Admin and another vdom set to vdom type Traffic.Which two GUI sections are available on both VDOM types? (Choose two.)

Security Fabric topology and external connectors

Refer to the exhibit. A customer is trying to setup a Playbook automation using a FortiAnalyzer, FortiWeb and FortiGate. The intention is to have the FortiGate quarantine any source of SQL Injection detected by the FortiWeb. They got the automation stitch to trigger on the FortiGate when simulating an attack to their website, but the quarantine object was created with the IP 0.0.0.0. Referring to the configuration and logs in the exhibits, which two statements are true? (Choose two.)

The Group By option in the handler should be different to src, so src can be used on the Playbook configuration.

The FortiAnalyzer ADOM Type must be Fabric.

The Group By option in the handler should be different to src, so src can be used on the Playbook configuration.

FortiSOC Playbooks combining FortiWeb and FortiGate are not supported.

To diagnose this issue, you need to use the command diagnose test application oftpd 22.

The FortiAnalyzer ADOM Type must be Fabric.

To fix the issue the parameter for script on the Playbook configuration should be epip.

A FortiGate is configured to perform outbound firewall authentication with Azure AD as a SAML IdP.What are two valid interactions that occur when the client attempts to access the internet? (Choose two.)

FortiGate SP sends a SAML request to the IdP.

The Microsoft SAML IdP sends the SAML response to the FortiGate SP.

FortiGate SP sends a SAML request to the IdP.

The Microsoft SAML IdP sends the SAML response to the FortiGate SP.

The client browser forwards the SAML response received from Microsoft SAML IdP to the FortiGate SP.

FortiGate SP redirects the client browser to the local captive portal and then redirects to the Microsoft SAML IdP.

Refer to the exhibits. During the implementation of a Fortinet Security Fabric configuration, CLI commands were issued in the order shown in the exhibit. On the next day, the local admin for FGTC issues the following command: FGTC # config system csfset configuration-sync defaultendIn this scenario, which outcome is true regarding the 'subnet_1' firewall address object on FGTC?

The object is automatically created.

The object will only be automatically created on FGTC if it is modified on FGTA-1.

The object needs to be recreated on FGTA-1 before it is automatically created on FGTC.

The object is not automatically created.

The object is automatically created.

Refer to the exhibits, which show a network topology and VPN configuration. A network administrator has been tasked with modifying the existing dial-up IPsec VPN infrastructure to detect the path quality to the remote endpoints.After applying the configuration shown in the configuration exhibit, the VPN clients can still connect and access the protected 172.16.205.0/24 network, but no SLA information shows up for the client tunnels when issuing the diagnose sys link-monitor tunnel all command on the FortiGate CLI.What is wrong with the configuration?

SLA link monitoring does not work with the net-device setting.

The admin needs to disable the mode-cfg setting.

IPsec Phase1 Interface has to be configured in IPsec main mode.

It is necessary to use the IKEv2 protocol in this situation.

Refer to the exhibit. A customer reports that they are not able to reach subnet 10.10.10.0/24 from their FortiGate device.Based on the exhibit, what should you do to correct the situation?

Enable recursive resolution for BGP routes

A FortiGate must be configured to accept VoIP traffic which will include session initiation protocol (SIP) traffic. Which statement about the VoIP configuration options is correct?

FortiOS cannot accept SIP traffic if both the SIP Session Helper and the application layer gateway (ALG) are disabled.

Restricting SIP requests is only possible when using the SIP Session Helper.

Rate tracking of SIP requests is only possible when the application layer gateway (ALG) is set to Flow mode.

FortiOS cannot accept SIP traffic if both the SIP Session Helper and the application layer gateway (ALG) are disabled.

By default, VoIP traffic will be processed using the SIP Session Helper.

Refer to the exhibits. You must integrate a FortiMail and FortiSandbox Enhanced Cloud solution for a customer who is concerned about the e-mails being delayed for too long.According to the configuration shown in the exhibits, which would be an expected behavior?

FortiMail will relay valid e-mails to the mail server as soon as it is done with other local inspections.

If an attachment is sent to the FortiSandbox while the job queue is full, the e-mail might be delayed for up to 30 minutes, then e-mail will be relayed to the mail server.

FortiMail will not wait for results but only for attachments that have been already submitted to the FortiSandbox in the last 60 minutes.

FortiMail will ignore the timeout value if content disarm and reconstruction (CDR) is enabled.

You have configured a Site-to-Site IPsec VPN tunnel between a FortiGate and a third-party device but notice that one of the error counters on the tunnel interface keeps increasing. Which two configuration options can resolve this problem? (Choose two.)

Enable DF-bit honoring in the global settings.

Adjust the MTU of the IPsec interface.

Enable Forward Error Correction (FEC) on the VPN interface for egress traffic.

Adjust the MTU of the physical interface to which the IPsec tunnel is bound.

Enable DF-bit honoring in the global settings.

Adjust the MTU of the IPsec interface.

A FortiGate deployment contains the following configuration: What is the result of this configuration?

Route-maps for VDOM SERVICES are excluded from HA configuration synchronization

Route-maps are not configurable in VDOM SERVICES

Route-maps from the Root VDOM configuration are available in VDOM SERVICES

Route-maps from VDOM SERVICES are available in all other VDOMs

Route-maps for VDOM SERVICES are excluded from HA configuration synchronization

A Hub FortiGate is connecting multiple branch FortiGate devices separating the traffic centrally in unique VRFs. Routing information is exchanged using BGP between the Hub and the Branch FortiGate devices.You want to efficiently enable route leaking of specific routes between the VRFs.Which two steps are required to achieve this requirement? (Choose two.)

Create a vdom link between VRF10 and VRF12

Configure route-maps to leak the selected routes using BGP

Create a vdom link between VRF10 and VRF12

Enable Multi-VDOM mode on the Hub FortiGate and add a VDOM to connect VRF10 and VRF12

Enable BGP recursive routing on the HUB FortiGate

Configure route-maps to leak the selected routes using BGP

Refer to the exhibit. You need to create a base SD-WAN configuration that includes SD-WAN rules and Performance SLAs for spoke sites with various connectivity types. It needs to be done in a way that can be easily applied to new sites with a minimum amount of change. How should you create the SD-WAN zones?

With members and assign overlay interfaces

With members without interface assignments

With members and assign interfaces but do not specify a gateway

Refer to the exhibit of a FortiNAC configuration. In this scenario, which two statements are correct? (Choose two.)

The IP address of the FortiSwitch is 10.12.240.2.

Port8 is connected to a FortiGate in FortiLink mode.

A device that is modeled in FortiNAC is connected on VLAN 4093.

An unknown host is connected to port3.

The IP address of the FortiSwitch is 10.12.240.2.

Port8 is connected to a FortiGate in FortiLink mode.

Refer to the exhibit. The Company Corp administrator has enabled Workflow mode in FortiManager and has assigned approval roles to the current administrators. However, workflow approval does not function as expected. The CTO is currently unable to approve submitted changes.Given the exhibit, which two possible solutions will resolve the workflow approval problems with the Workflow_72 ADOM? (Choose two.)

The CTO must have a defined email address for their admin user account.

The CTO must have Standard access level or higher for FortiManager.

The CTO must have a defined email address for their admin user account.

The CTO and CISO need to swap Approval Groups so that the highest authority is in Group #1.

The CTO must have Standard access level or higher for FortiManager.

The CISO must have a higher access level than 'Read_Only_User' in FortiManager.

The CTO needs to be added to 'Email Notification' in the Workflow_72 ADOM.

Fortinet NSE8_812 Practice Test 3 - Free Online Exam Prep & Questions

Refer to the exhibit, which shows a multi-region SD-WAN architecture.

Fortinet NSE8_812 image Question 21 63877670159440663291976

Given this scenario, which two statements are true? (Choose two.)

Become a Premium Member for full access

Unlock Premium Member

Fortinet NSE8_812 Practice Test 3

Question

Fortinet NSE8_812 Practice Tests

Practice Tests