ExamGecko
Home / Fortinet / NSE8_812 / List of questions
Ask Question

Fortinet NSE8_812 Practice Test - Questions Answers, Page 3

Add to Whishlist

List of questions

Question 21

Report Export Collapse

Refer to the exhibits.

Fortinet NSE8_812 image Question 21 63877670106547246435344

Fortinet NSE8_812 image Question 21 63877670106547246435344

A customer wants to deploy 12 FortiAP 431F devices on high density conference center, but they do not currently have any PoE switches to connect them to. They want to be able to run them at full power while having network redundancy

From the FortiSwitch models and sample retail prices shown in the exhibit, which build of materials would have the lowest cost, while fulfilling the customer's requirements?

1x FortiSwitch 248EFPOE

1x FortiSwitch 248EFPOE

2x FortiSwitch 224E-POE

2x FortiSwitch 224E-POE

2x FortiSwitch 248E-FPOE

2x FortiSwitch 248E-FPOE

2x FortiSwitch 124E-FPOE

2x FortiSwitch 124E-FPOE

Suggested answer: D
Explanation:

the access point will require about 24.5 W of power and the 124E-FPOE has a Capacity of about 370 meaning 25x12 = 300 so you left with about 70 W on the switch meaning you can still add two more access point on that switch.

asked 15/03/2025
Sebastian van de Zweerde
50 questions

Question 22

Report Export Collapse

Refer to the exhibits.

Fortinet NSE8_812 image Question 22 63877670106781615010592

Fortinet NSE8_812 image Question 22 63877670106781615010592

A customer is looking for a solution to authenticate the clients connected to a hardware switch interface of a FortiGate 400E.

Referring to the exhibits, which two conditions allow authentication to the client devices before assigning an IP address? (Choose two.)

FortiGate devices with NP6 and hardware switch interfaces cannot support 802.1X authentication.

FortiGate devices with NP6 and hardware switch interfaces cannot support 802.1X authentication.

Devices connected directly to ports 3 and 4 can perform 802 1X authentication.

Devices connected directly to ports 3 and 4 can perform 802 1X authentication.

Ports 3 and 4 can be part of different switch interfaces.

Ports 3 and 4 can be part of different switch interfaces.

Client devices must have 802 1X authentication enabled

Client devices must have 802 1X authentication enabled

Suggested answer: B, D
Explanation:

The customer wants to deploy a solution to authenticate the clients connected to a hardware switch interface of a FortiGate 400E device. A hardware switch interface is an interface that combines multiple physical interfaces into one logical interface, allowing them to act as a single switch with one IP address and one set of security policies. The customer wants to use 802.1X authentication for this solution, which is a standard protocol for port-based network access control (PNAC) that authenticates clients based on their credentials before granting them access to network resources. One condition that allows authentication to the client devices before assigning an IP address is that devices connected directly to ports 3 and 4 can perform 802.1X authentication. This is because ports 3 and 4 are part of the hardware switch interface named ''lan'', which has an IP address of 10.10.10.254/24 and an inbound SSL inspection profile named ''ssl-inspection''. The inbound SSL inspection profile enables the FortiGate device to intercept and inspect SSL/TLS traffic from clients before forwarding it to servers, which allows it to apply security policies and features such as antivirus, web filtering, application control, etc. However, before performing SSL inspection, the FortiGate device needs to authenticate the clients using 802.1X authentication, which requires the clients to send their credentials (such as username and password) to the FortiGate device over a secure EAP (Extensible Authentication Protocol) channel. The FortiGate device then verifies the credentials with an authentication server (such as RADIUS or LDAP) and grants or denies access to the clients based on the authentication result. Therefore, devices connected directly to ports 3 and 4 can perform 802.1X authentication before assigning an IP address. Another condition that allows authentication to the client devices before assigning an IP address is that client devices must have 802.1X authentication enabled. This is because 802.1X authentication is a mutual process that requires both the client devices and the FortiGate device to support and enable it. The client devices must have 802.1X authentication enabled in their network settings, which allows them to initiate the authentication process when they connect to the hardware switch interface of the FortiGate device. The client devices must also have an 802.1X supplicant software installed, which is a program that runs on the client devices and handles the communication with the FortiGate device using EAP messages. The client devices must also have a trusted certificate installed, which is used to verify the identity of the FortiGate device and establish a secure EAP channel. Therefore, client devices must have 802.1X authentication enabled before assigning an IP address.

Reference: https://docs.fortinet.com/document/fortigate/7.0.0/administration-guide/19662/hardware-switch-interfaces https://docs.fortinet.com/document/fortigate/7.0.0/administration-guide/19662/802-1x-authentication

https://docs.fortinet.com/document/fortigate/7.2.0/new-features/959502/support-802-1x-on-virtual-switch-for-certain-np6-platforms

asked 15/03/2025
Gaetano Vito Fraccalvieri
47 questions

Question 23

Report Export Collapse

You want to use the MTA adapter feature on FortiSandbox in an HA-Cluster. Which statement about this solution is true?

The configuration of the MTA Adapter Local Interface is different than on port1.

The configuration of the MTA Adapter Local Interface is different than on port1.

The MTA adapter is only available in the primary node.

The MTA adapter is only available in the primary node.

The MTA adapter mode is only detection mode.

The MTA adapter mode is only detection mode.

The configuration is different than on a standalone device.

The configuration is different than on a standalone device.

Suggested answer: B
Explanation:

The MTA adapter feature on FortiSandbox is a feature that allows FortiSandbox to act as a mail transfer agent (MTA) that can receive, inspect, and forward email messages from external sources. The MTA adapter feature can be used to integrate FortiSandbox with third-party email security solutions that do not support direct integration with FortiSandbox, such as Microsoft Exchange Server or Cisco Email Security Appliance (ESA). The MTA adapter feature can also be used to enhance email security by adding an additional layer of inspection and filtering before delivering email messages to the final destination. The MTA adapter feature can be enabled on FortiSandbox in an HA-Cluster, which is a configuration that allows two FortiSandbox units to synchronize their settings and data and provide high availability and load balancing for sandboxing services. However, one statement about this solution that is true is that the MTA adapter is only available in the primary node. This means that only one FortiSandbox unit in the HA-Cluster can act as an MTA and receive email messages from external sources, while the other unit acts as a backup node that can take over the MTA role if the primary node fails or loses connectivity. This also means that only one IP address or FQDN can be used to configure the external sources to send email messages to the FortiSandbox MTA, which is the IP address or FQDN of the primary node.

Reference: https://docs.fortinet.com/document/fortisandbox/3.2.0/administration-guide/19662/mail-transfer-agent-mta https://docs.fortinet.com/document/fortisandbox/3.2.0/administration-guide/19662/high-availability-ha

https://docs.fortinet.com/document/fortisandbox/4.4.3/administration-guide/877925/mta-adapter

asked 15/03/2025
William Sorensen
45 questions

Question 24

Report Export Collapse

Refer to the exhibit showing the history logs from a FortiMail device.

Fortinet NSE8_812 image Question 24 63877670106875362699793

Which FortiMail email security feature can an administrator enable to treat these emails as spam?

DKIM validation in a session profile

DKIM validation in a session profile

Sender domain validation in a session profile

Sender domain validation in a session profile

Impersonation analysis in an antispam profile

Impersonation analysis in an antispam profile

Soft fail SPF validation in an antispam profile

Soft fail SPF validation in an antispam profile

Suggested answer: C
Explanation:

Impersonation analysis is a feature that detects emails that attempt to impersonate a trusted sender, such as a company executive or a well-known brand, by using spoofed or look-alike email addresses. This feature can help prevent phishing and business email compromise (BEC) attacks. Impersonation analysis can be enabled in an antispam profile and applied to a firewall policy.

Reference: https://docs.fortinet.com/document/fortimail/6.4.0/administration-guide/103663/impersonation-analysis

https://docs.fortinet.com/document/fortimail/7.2.0/cookbook/221814/protecting-against-email-impersonation-in-fortimail

asked 15/03/2025
Manoj Balan
56 questions

Question 25

Report Export Collapse

Refer to the exhibits, which show a firewall policy configuration and a network topology.

Fortinet NSE8_812 image Question 25 6387767010725035288845

An administrator has configured an inbound SSL inspection profile on a FortiGate device (FG-1) that is protecting a data center hosting multiple web pages-Given the scenario shown in the exhibits, which certificate will FortiGate use to handle requests to xyz.com?

FortiGate will fall-back to the default Fortinet_CA_SSL certificate.

FortiGate will fall-back to the default Fortinet_CA_SSL certificate.

FortiGate will reject the connection since no certificate is defined.

FortiGate will reject the connection since no certificate is defined.

FortiGate will use the Fortinet_CA_Untrusted certificate for the untrusted connection,

FortiGate will use the Fortinet_CA_Untrusted certificate for the untrusted connection,

FortiGate will use the first certificate in the server-cert list---the abc.com certificate

FortiGate will use the first certificate in the server-cert list---the abc.com certificate

Suggested answer: D
Explanation:

https://docs.fortinet.com/document/fortigate/7.4.1/administration-guide/850344/define-multiple-certificates-in-an-ssl-profile-in-replace-mode If there is no matched server certificate in the list, then the first server certificate in the list is used as a replacement.

asked 15/03/2025
Kunle Fodeke
54 questions

Question 26

Report Export Collapse

Refer to the exhibits.

Fortinet NSE8_812 image Question 26 6387767010792221101864

A FortiGate cluster (CL-1) protects a data center hosting multiple web applications. A pair of FortiADC devices are already configured for SSL decryption (FAD-1), and re-encryption (FAD-2). CL-1 must accept unencrypted traffic from FAD-1, perform application detection on the plain-text traffic, and forward the inspected traffic to FAD-2.

The SSL-Offload-App-Detect application list and SSL-Offload protocol options profile are applied to the firewall policy handling the web application traffic on CL-1.

Given this scenario, which two configuration tasks must the administrator perform on CL-1? (Choose two.)

A)

Fortinet NSE8_812 image Question 26 6387767010792221101864

B)

Fortinet NSE8_812 image Question 26 6387767010792221101864

Fortinet NSE8_812 image Question 26 6387767010792221101864

Fortinet NSE8_812 image Question 26 6387767010792221101864

Option A

Option A

Option B

Option B

Option C

Option C

Option D

Option D

Suggested answer: B, C
Explanation:

To enable application detection on plain-text traffic that has been decrypted by FortiADC, the administrator must perform two configuration tasks on CL-1:

Enable SSL offloading in the firewall policy and select the SSL-Offload protocol options profile.

Enable application control in the firewall policy and select the SSL-Offload-App-Detect application list.

Reference: https://docs.fortinet.com/document/fortigate/6.4.0/cookbook/103438/application-detection-on-ssl-offloaded-traffic

asked 15/03/2025
Nisanka Mandara
40 questions

Question 27

Report Export Collapse

You are migrating the branches of a customer to FortiGate devices. They require independent routing tables on the LAN side of the network.

After reviewing the design, you notice the firewall will have many BGP sessions as you have two data centers (DC) and two ISPs per DC while each branch is using at least 10 internal segments.

Based on this scenario, what would you suggest as the more efficient solution, considering that in the future the number of internal segments, DCs or internet links per DC will increase?

No change in design is needed as even small FortiGate devices have a large memory capacity.

No change in design is needed as even small FortiGate devices have a large memory capacity.

Acquire a FortiGate model with more capacity, considering the next 5 years growth.

Acquire a FortiGate model with more capacity, considering the next 5 years growth.

Implement network-id, neighbor-group and increase the advertisement-interval

Implement network-id, neighbor-group and increase the advertisement-interval

Redesign the SD-WAN deployment to only use a single VPN tunnel and segment traffic using VRFs on BGP

Redesign the SD-WAN deployment to only use a single VPN tunnel and segment traffic using VRFs on BGP

Suggested answer: D
Explanation:

https://docs.fortinet.com/document/fortigate/7.4.1/administration-guide/810981/sd-wan-segmentation-over-a-single-overlay

asked 15/03/2025
Easwari Lakshminarayanan
50 questions

Question 28

Report Export Collapse

You must analyze an event that happened at 20:37 UTC. One log relevant to the event is extracted from FortiGate logs:

Fortinet NSE8_812 image Question 28 63877670107937835365982

The devices and the administrator are all located in different time zones Daylight savings time (DST) is disabled

* The FortiGate is at GMT-1000.

* The FortiAnalyzer is at GMT-0800

* Your browser local time zone is at GMT-03.00

You want to review this log on FortiAnalyzer GUI, what time should you use as a filter?

20:37:08

20:37:08

10:37:08

10:37:08

17:37:08

17:37:08

12.37:08

12.37:08

Suggested answer: D
Explanation:

https://community.fortinet.com/t5/FortiAnalyzer/Technical-Note-Understanding-FortiAnalyzer-time-related-fields/ta-p/197569

asked 15/03/2025
Manuel Ortega
48 questions

Question 29

Report Export Collapse

A customer is planning on moving their secondary data center to a cloud-based laaS. They want to place all the Oracle-based systems Oracle Cloud, while the other systems will be on Microsoft Azure with ExpressRoute service to their main data center.

They have about 200 branches with two internet services as their only WAN connections. As a security consultant you are asked to design an architecture using Fortinet products with security, redundancy and performance as a priority.

Which two design options are true based on these requirements? (Choose two.)

Systems running on Azure will need to go through the main data center to access the services on Oracle Cloud.

Systems running on Azure will need to go through the main data center to access the services on Oracle Cloud.

Use FortiGate VM for IPSEC over ExpressRoute, as traffic is not encrypted by Azure.

Use FortiGate VM for IPSEC over ExpressRoute, as traffic is not encrypted by Azure.

Branch FortiGate devices must be configured as VPN clients for the branches' internal network to be able to access Oracle services without using public IPs.

Branch FortiGate devices must be configured as VPN clients for the branches' internal network to be able to access Oracle services without using public IPs.

Two ExpressRoute services to the main data center are required to implement SD-WAN between a FortiGate VM in Azure and a FortiGate device at the data center edge

Two ExpressRoute services to the main data center are required to implement SD-WAN between a FortiGate VM in Azure and a FortiGate device at the data center edge

Suggested answer: B, C
Explanation:

A . Systems running on Azure will need to go through the main data center to access the services on Oracle Cloud. This is because the Oracle Cloud is not directly connected to the Azure Cloud. The traffic will need to go through the main data center in order to reach the Oracle Cloud.

C . Branch FortiGate devices must be configured as VPN clients for the branches' internal network to be able to access Oracle services without using public IPs. This is because the Oracle Cloud does not allow direct connections from the internet. The traffic will need to go through the FortiGate devices in order to reach the Oracle Cloud.

The other options are not correct.

B . Use FortiGate VM for IPSEC over ExpressRoute, as traffic is not encrypted by Azure. This is not necessary. Azure does encrypt traffic over ExpressRoute.

D . Two ExpressRoute services to the main data center are required to implement SD-WAN between a FortiGate VM in Azure and a FortiGate device at the data center edge. This is not necessary. A single ExpressRoute service can be used to implement SD-WAN between a FortiGate VM in Azure and a FortiGate device at the data center edge.

https://learn.microsoft.com/en-us/azure/expressroute/expressroute-about-encryption

asked 15/03/2025
Kabi Bashala
37 questions

Question 30

Report Export Collapse

Refer to the exhibit, which shows the high availability configuration for the FortiAuthenticator (FAC1).

Fortinet NSE8_812 image Question 30 63877670108094080916148

Based on this information, which statement is true about the next FortiAuthenticator (FAC2) member that will join an HA cluster with this FortiAuthenticator (FAC1)?

FAC2 can only process requests when FAC1 fails.

FAC2 can only process requests when FAC1 fails.

FAC2 can have its HA interface on a different network than FAC1.

FAC2 can have its HA interface on a different network than FAC1.

The FortiToken license will need to be installed on the FAC2.

The FortiToken license will need to be installed on the FAC2.

FSSO sessions from FAC1 will be synchronized to FAC2.

FSSO sessions from FAC1 will be synchronized to FAC2.

Suggested answer: B
Explanation:

https://docs.fortinet.com/document/fortiauthenticator/6.5.3/administration-guide/122076/high-availability

https://docs.fortinet.com/document/fortiauthenticator/6.5.3/administration-guide/122076/high-availability#Standalo

asked 15/03/2025
Maryna Zarytska
38 questions
Total 105 questions
Go to page: of 11
Search

Related questions