Fortinet NSE8_812 Practice Test - Questions Answers, Page 4

ZTNA supports SSH connection rules that allow remote workers to access SSH servers inside the network through an HTTPS tunnel between the client and the access proxy (FortiGate). The access proxy acts as an SSH client to connect to the real SSH server on behalf of the user, and performs hostkey validation to verify the identity of the server. The user can use any SSH client that supports HTTPS proxy settings, such as PuTTY or OpenSSH. Reference:

https://docs.fortinet.com/document/fortigate/7.0.0/ztna-deployment/899992/configuring-ztnarules-to-control-access

To control multicast traffic passing through a FortiGate configured in transparent mode, you can use multicast policies. Multicast policies allow you to filter multicast traffic based on source and destination addresses, protocols, and interfaces. You can also apply security profiles to scan multicast traffic for threats and violations. Reference:

https://docs.fortinet.com/document/fortigate/6.2.14/cookbook/968606/configuring-multicastforwarding

When an HTTP/2 request comes in, FortiGate will strip the Application-Layer Protocol Negotiation (ALPN) header and forward the traffic as HTTP/1.1 to the real server. This is because FortiGate does not support HTTP/2 inspection, and therefore cannot process ALPN headers that indicate HTTP/2 support. Reference:

https://docs.fortinet.com/document/fortigate/6.4.0/cookbook/103438/application-detection-on-ssloffloaded-traffic

The output of the status of high availability on the FortiGate shows that the cluster mode is activepassive, which means that only one FortiGate unit is active at a time, while the other unit is in standby mode. The active unit handles all traffic and also sends HA heartbeat packets to monitor the standby unit. The standby unit becomes active if it stops receiving heartbeat packets from the active unit, or if it receives a higher priority from another cluster unit. In active-passive mode, all cluster units share a virtual MAC address for each interface, which is used as the source MAC address for all packets forwarded by the cluster. Reference:

https://docs.fortinet.com/document/fortigate/6.4.0/cookbook/103439/high-availability-with-twofortigates

According to the exhibit, the SD-WAN configuration has two rules: one for traffic to 10.1.100.0/24 subnet, and one for traffic to 10.1.100.16/28 subnet. The first rule uses the best quality strategy, which selects the SD-WAN member with the best measured quality based on performance SLA metrics. The second rule uses the manual strategy, which specifies port1 as the SD-WAN member to select. Therefore, if an internal user pings 10.1.100.2 and 10.1.100.22 from subnet 172.16.205.0/24, the outgoing interfaces will be port16 and port1 respectively, assuming that port16 has the best quality among the SD-WAN members. Reference:

https://docs.fortinet.com/document/fortigate/6.2.14/cookbook/218559/configuring-the-sd-waninterface

To implement security for the traffic between two VPCs in AWS, while keeping separate management of each department's VPC, two possible actions are:

Create a transit VPC with a FortiGate HA cluster, connect to the other two using VPC peering, and use routing tables to force traffic through the FortiGate cluster. This option allows the cybersecurity department to manage the transit VPC and apply security policies on the FortiGate cluster, while the other departments can manage their own VPCs and instances. The VPC peering connections enable direct communication between the VPCs without using public IPs or gateways. The routing tables can be configured to direct all inter-VPC traffic to the transit VPC.

Create a VPC with a FortiGate auto-scaling group with a Transit Gateway attached to the three VPCs to force routing through the FortiGate cluster. This option also allows the cybersecurity department to manage the security VPC and apply security policies on the FortiGate cluster, while the other departments can manage their own VPCs and instances. The Transit Gateway acts as a network hub that connects multiple VPCs and on-premises networks. The routing tables can be configured to direct all inter-VPC traffic to the security VPC. Reference:

https://docs.fortinet.com/document/fortigate-public-cloud/7.2.0/aws-administrationguide/ 506140/connecting-a-local-fortigate-to-an-aws-vpc-vpn

https://docs.fortinet.com/document/fortigate-public-cloud/7.0.0/sd-wan-architecture-forenterprise/ 166334/sd-wan-configuration

To resolve the issue of failing to renew the Let's Encrypt certificate, the configuration change that is needed is to enable the HTTP-to-HTTPS redirect option in the SSL-VPN settings. This option allows the FortiGate to redirect HTTP requests to HTTPS port 443, which is required for Let's Encrypt to validate the domain ownership and issue a new certificate. By enabling this option, the FortiGate will be able to respond to the HTTP challenge from Let's Encrypt and renew the certificate successfully.

Reference: https://docs.fortinet.com/document/fortigate/6.4.0/cookbook/103437/inbound-sslinspection

https://docs.fortinet.com/document/fortigate/6.4.0/cookbook/103438/applicationdetection-on-ssl-offloaded-traffic

The exhibit shows the forensics analysis of an event detected by the FortiEDR core. The event graph indicates that a process named svchost.exe was launched by a malicious file named 1.exe, which was downloaded from a suspicious URL. The process then attempted to encrypt files in various folders, such as Documents, Pictures, and Desktop, which are typical targets of ransomware attacks.

However, FortiEDR was able to stop the process and prevent any file encryption by applying its realtime post-execution prevention feature. Therefore, this is a ransomware attack and has been stopped by FortiEDR. Reference: https://docs.fortinet.com/document/fortiedr/6.0.0/administrationguide/ 733983/forensics https://www.fortinet.com/content/dam/fortinet/assets/datasheets/ fortiedr.pdf

To execute the CLI script shown using an incoming webhook as the trigger, the correct syntax for the curl command is: curl -X POST -H "Content-Type: application/json" -d '{"trigger_name":"my_incoming_webhook"}' https://fortisoar.example.com/api/v1/trigger This command will send a POST request to the FortiSOAR API endpoint with the trigger name and the content type as JSON. The FortiSOAR API will then execute the automation stitch that matches the trigger name and run the CLI script on the FortiGate device. Reference:

https://docs.fortinet.com/document/fortisoar/7.0.0/administration-guide/103440/automationstitches

https://docs.fortinet.com/document/fortisoar/7.0.0/administrationguide/ 103441/incoming-webhook