Home / Fortinet / NSE8_812

Fortinet NSE8_812 Practice Test - Questions Answers, Page 5

Question list

List of questions

Question 41

(0)

A customer wants to use the FortiAuthenticator REST API to retrieve an SSO group called SalesGroup. The following API call is being made with the 'curl' utility: Which two statements correctly d

Question 42

(0)

Refer to the exhibit. A customer has deployed a FortiGate 200F high-availability (HA) cluster that contains & TPM chip. The exhibit shows output from the FortiGate CLI session where the admi

Question 43

(0)

Refer to the exhibits. The exhibits show a FortiMail network topology, Inbound configuration settings, and a Dictionary Profile. You are required to integrate a third-party's host service (srv.t

Question 44

(0)

Refer to the exhibit showing a FortiSOAR playbook. You are investigating a suspicious e-mail alert on FortiSOAR, and after reviewing the executed playbook, you can see that it requires interventi

Question 45

(0)

Review the following FortiGate-6000 configuration excerpt: Based on the configuration, which statement is correct regarding SNAT source port partitioning behavior?

Question 46

(0)

Refer to the exhibit. You have been tasked with replacing the managed switch Forti Switch 2 shown in the topology. Which two actions are correct regarding the replacement process? (Choose two.)

Question 47

(0)

A customer with a FortiDDoS 200F protecting their fibre optic internet connection from incoming traffic sees that all the traffic was dropped by the device even though they were not under a DoS atta

Question 48

(0)

Refer to the exhibit. The exhibit shows two error messages from a FortiGate root Security Fabric device when you try to configure a new connection to a FortiClient EMS Server. Referring to the e

Question 49

(0)

An administrator has configured a FortiGate device to authenticate SSL VPN users using digital certificates. A FortiAuthenticator is the certificate authority (CA) and the Online Certificate Status

Question 50

(0)

Refer to the exhibit. To facilitate a large-scale deployment of SD-WAN/ADVPN with FortiGate devices, you are tasked with configuring the FortiGate devices to support injecting of IKE routes on th

Related questions

An HA topology is using the following configuration: Based on this configuration, how long will it take for a failover to be detected by the secondary cluster member?

Refer to the exhibit showing a firewall policy configuration. To prevent unauthorized access of their cloud assets, an administrator wants to enforce authentication on firewall policy ID 1. What change does the administrator need to make? A) B) C) D)

Refer to the exhibits. An administrator has configured a FortiGate and Forti Authenticator for two-factor authentication with FortiToken push notifications for their SSL VPN login. Upon initial review of the setup, the administrator has discovered that the customers can manually type in their two-factor code and authenticate but push notifications do not work Based on the information given in the exhibits, what must be done to fix this?

You are troubleshooting a FortiMail Cloud service integrated with Office 365 where outgoing emails are not reaching the recipients' mail What are two possible reasons for this problem? (Choose two.)

You are creating the CLI script to be used on a new SD-WAN deployment You will have branches with a different number of internet connections and want to be sure there is no need to change the Performance SLA configuration in case more connections are added to the branch. The current configuration is: Which configuration do you use for the Performance SLA members?

Refer to the exhibits. The exhibits show a diagram of a requested topology and the base IPsec configuration. A customer asks you to configure ADVPN via two internet underlays. The requirement is that you use one interface with a single IP address on DC FortiGate. In this scenario, which feature should be implemented to achieve this requirement?

You are running a diagnose command continuously as traffic flows through a platform with NP6 and you obtain the following output: Given the information shown in the output, which two statements are true? (Choose two.)

A customer is planning on moving their secondary data center to a cloud-based laaS. They want to place all the Oracle-based systems Oracle Cloud, while the other systems will be on Microsoft Azure with ExpressRoute service to their main data center. They have about 200 branches with two internet services as their only WAN connections. As a security consultant you are asked to design an architecture using Fortinet products with security, redundancy and performance as a priority. Which two design options are true based on these requirements? (Choose two.)

SD-WAN is configured on a FortiGate. You notice that when one of the internet links has high latency the time to resolve names using DNS from FortiGate is very high. You must ensure that the FortiGate DNS resolution times are as low as possible with the least amount of work. What should you configure?

You are responsible for recommending an adapter type for NICs on a FortiGate VM that will run on an ESXi Hypervisor. Your recommendation must consider performance as the main concern, cost is not a factor. Which adapter type for the NICs will you recommend?

Question 41

A customer wants to use the FortiAuthenticator REST API to retrieve an SSO group called SalesGroup.

The following API call is being made with the 'curl' utility:

Which two statements correctly describe the expected behavior of the FortiAuthenticator REST API?

(Choose two.)

Only users with the "Full permission" role can access the REST API

This API call will fail because it requires that API version 2

If the REST API web service access key is lost, it cannot be retrieved and must be changed.

The syntax is incorrect because the API calls needs the get method.

Show Answer Comment (0)

Question 42

Refer to the exhibit.

A customer has deployed a FortiGate 200F high-availability (HA) cluster that contains & TPM chip.

The exhibit shows output from the FortiGate CLI session where the administrator enabled TPM.

Following these actions, the administrator immediately notices that both FortiGate high availability (HA) status and FortiManager status for the FortiGate are negatively impacted.

What are the two reasons for this behavior? (Choose two.)

The private-data-encryption key entered on the primary did not match the value that the TPM expected.

Configuration for TPM is not synchronized between FortiGate HA cluster members.

The FortiGate has not finished the auto-update process to synchronize the new configuration to FortiManager yet.

TPM functionality is not yet compatible with FortiGate HA D The administrator needs to manually enter the hex private data encryption key in FortiManager

Show Answer Comment (0)

Question 43

Refer to the exhibits.

The exhibits show a FortiMail network topology, Inbound configuration settings, and a Dictionary Profile.

You are required to integrate a third-party's host service (srv.thirdparty.com) into the e-mail processing path.

All inbound e-mails must be processed by FortiMail antispam and antivirus with FortiSandbox integration. If the email is clean, FortiMail must forward it to the third-party service, which will send the email back to FortiMail for final delivery, FortiMail must not scan the e-mail again.

Which three configuration tasks must be performed to meet these requirements? (Choose three.)

Change the scan order in FML-GW to antispam-sandbox-content.

Apply the Catch-Ail profile to the CFInbound profile and configure a content action profile to deliver to the srv. thirdparty. com FQDN

Create an access receive rule with a Sender value of srv. thirdparcy.com, Recipient value of*@acme.com, and action value of Safe

Apply the Catch-AII profile to the ASinbound profile and configure an access delivery rule to deliver to the 100.64.0.72 host.

Create an IP policy with a Source value of 100. 64 .0.72/32, enable precedence, and place the policy at the top of the list.

Show Answer Comment (0)

Question 44

Refer to the exhibit showing a FortiSOAR playbook.

You are investigating a suspicious e-mail alert on FortiSOAR, and after reviewing the executed playbook, you can see that it requires intervention.

What should be your next step?

Go to the Incident Response tasks dashboard and run the pending actions

Click on the notification icon on FortiSOAR GUI and run the pending input action

Run the Mark Drive by Download playbook action

Reply to the e-mail with the requested Playbook action

Show Answer Comment (0)

Question 45

Review the following FortiGate-6000 configuration excerpt:

Based on the configuration, which statement is correct regarding SNAT source port partitioning behavior?

It dynamically distributes SNAT source ports to operating FPCs or FPMs.

It is the default SNAT configuration and preserves active sessions when an FPC or FPM goes down.

It statically distributes SNAT source ports to operating FPCs or FPMs

It equally distributes SNAT source ports across chassis slots.

Show Answer Comment (0)

Question 46

Refer to the exhibit.

You have been tasked with replacing the managed switch Forti Switch 2 shown in the topology.

Which two actions are correct regarding the replacement process? (Choose two.)

After replacing the FortiSwitch unit, the automatically created trunk name does not change

CLAG-ICL needs to be manually reconfigured once the new switch is connected to the FortiGate

After replacing the FortiSwitch unit, the automatically created trunk name changes.

MCLAG-ICL will be automatically reconfigured once the new switch is connected to the FortiGate.

Show Answer Comment (0)

Question 47

A customer with a FortiDDoS 200F protecting their fibre optic internet connection from incoming traffic sees that all the traffic was dropped by the device even though they were not under a DoS attack. The traffic flow was restored after it was rebooted using the GUI. Which two options will prevent this situation in the future? (Choose two)

Change the Adaptive Mode.

Create an HA setup with a second FortiDDoS 200F

Move the internet connection from the SFP interfaces to the LC interfaces

Replace with a FortiDDoS 1500F

Show Answer Comment (0)

Question 48

Refer to the exhibit.

The exhibit shows two error messages from a FortiGate root Security Fabric device when you try to configure a new connection to a FortiClient EMS Server.

Referring to the exhibit, which two actions will fix these errors? (Choose two.)

Verify that the CRL is accessible from the root FortiGate

Export and import the FortiClient EMS server certificate to the root FortiGate.

Install a new known CA on the Win2K16-EMS server.

Authorize the root FortiGate on the FortiClient EMS

Show Answer Comment (0)

Question 49

An administrator has configured a FortiGate device to authenticate SSL VPN users using digital certificates. A FortiAuthenticator is the certificate authority (CA) and the Online Certificate Status Protocol (OCSP) server.

Part of the FortiGate configuration is shown below:

Based on this configuration, which two statements are true? (Choose two.)

OCSP checks will always go to the configured FortiAuthenticator

The OCSP check of the certificate can be combined with a certificate revocation list.

OCSP certificate responses are never cached by the FortiGate.

If the OCSP server is unreachable, authentication will succeed if the certificate matches the CA.

Show Answer Comment (0)

Question 50

Refer to the exhibit.

To facilitate a large-scale deployment of SD-WAN/ADVPN with FortiGate devices, you are tasked with configuring the FortiGate devices to support injecting of IKE routes on the ADVPN shortcut tunnels.

Which three commands must be added or changed to the FortiGate spoke config vpn ipsec phaseiinterface options referenced in the exhibit for the VPN interface to enable this capability? (Choose three.)

set net-device disable

set mode-cfg enable

set ike-version 1

set add-route enable

set mode-cfg-allow-client-selector enable

Show Answer Comment (0)

Total 60 questions

2 3 4 5 6

Go to page: of 6