Download Free Fortinet NSE8_812 Exam Questions & Answer
Online VALID NSE8_812 Exam Dumps File Instantly
NEW QUESTION # 12
Refer to the exhibits.
The exhibits show a FortiGate network topology and the output of the status of high availability on the FortiGate.
Given this information, which statement is correct?
- A. FGVMEVLQOG33WM3D and FGVMEVGCJNHFYI4A share a virtual MAC address.
- B. The ethertype values of the HA packets are 0x8890, 0x8891, and 0x8892
- C. The cluster members are on the same network and the IP addresses were statically assigned.
- D. The cluster mode can support a maximum of four (4) FortiGate VMs
Answer: A
Explanation:
The output of the status of high availability on the FortiGate shows that the cluster mode is active-passive, which means that only one FortiGate unit is active at a time, while the other unit is in standby mode. The active unit handles all traffic and also sends HA heartbeat packets to monitor the standby unit. The standby unit becomes active if it stops receiving heartbeat packets from the active unit, or if it receives a higher priority from another cluster unit. In active-passive mode, all cluster units share a virtual MAC address for each interface, which is used as the source MAC address for all packets forwarded by the cluster. References: https://docs.fortinet.com/document/fortigate/6.4.0/cookbook/103439/high-availability-with-two-fortigates
NEW QUESTION # 13
Which two methods are supported for importing user defined Lookup Table Data into the FortiSIEM? (Choose two.)
- A. FTP
- B. SCP
- C. API
- D. Report
Answer: C,D
Explanation:
FortiSIEM supports two methods for importing user defined Lookup Table Data:
Report: You can import lookup table data from a report. This is the most common method for importing lookup table data.
API: You can also import lookup table data using the FortiSIEM API. This is a more advanced method that allows you to import lookup table data programmatically.
FTP, SCP, and other file transfer protocols are not supported for importing lookup table data into FortiSIEM.
NEW QUESTION # 14
Refer to the exhibit showing the history logs from a FortiMail device.
Which FortiMail email security feature can an administrator enable to treat these emails as spam?
- A. Sender domain validation in a session profile
- B. Impersonation analysis in an antispam profile
- C. DKIM validation in a session profile
- D. Soft fail SPF validation in an antispam profile
Answer: B
Explanation:
Impersonation analysis is a feature that detects emails that attempt to impersonate a trusted sender, such as a company executive or a well-known brand, by using spoofed or look-alike email addresses. This feature can help prevent phishing and business email compromise (BEC) attacks. Impersonation analysis can be enabled in an antispam profile and applied to a firewall policy. Reference: https://docs.fortinet.com/document/fortimail/6.4.0/administration-guide/103663/impersonation-analysis
NEW QUESTION # 15
Refer to the CLI configuration of an SSL inspection profile from a FortiGate device configured to protect a web server:
Based on the information shown, what is the expected behavior when an HTTP/2 request comes in?
- A. FortiGate will reject all HTTP/2 ALPN headers.
- B. FortiGate will rewrite the ALPN header to request HTTP/1.
- C. FortiGate will strip the ALPN header and forward the traffic.
- D. FortiGate will forward the traffic without modifying the ALPN header.
Answer: C
Explanation:
When an HTTP/2 request comes in, FortiGate will strip the Application-Layer Protocol Negotiation (ALPN) header and forward the traffic as HTTP/1.1 to the real server. This is because FortiGate does not support HTTP/2 inspection, and therefore cannot process ALPN headers that indicate HTTP/2 support. Reference: https://docs.fortinet.com/document/fortigate/6.4.0/cookbook/103438/application-detection-on-ssl-offloaded-traffic
NEW QUESTION # 16
On a FortiGate Configured in Transparent mode, which configuration option allows you to control Multicast traffic passing through the?
- A.
- B.
- C.
- D.
Answer: D
Explanation:
To control multicast traffic passing through a FortiGate configured in transparent mode, you can use multicast policies. Multicast policies allow you to filter multicast traffic based on source and destination addresses, protocols, and interfaces. You can also apply security profiles to scan multicast traffic for threats and violations. References: https://docs.fortinet.com/document/fortigate/6.2.14/cookbook/968606/configuring-multicast-forwarding
NEW QUESTION # 17
A remote IT Team is in the process of deploying a FortiGate in their lab. The closed environment has been configured to support zero-touch provisioning from the FortiManager, on the same network, via DHCP options. After waiting 15 minutes, they are reporting that the FortiGate received an IP address, but the zero-touch process failed.
The exhibit below shows what the IT Team provided while troubleshooting this issue:
Which statement explains why the FortiGate did not install its configuration from the FortiManager?
- A. The DHCP server was not configured with the FQDN of the FortiManager
- B. The configuration was modified on the FortiGate prior to connecting to the FortiManager
- C. The DHCP server used the incorrect option type for the FortiManager IP address.
- D. The FortiGate was not configured with the correct pre-shared key to connect to the FortiManager
Answer: C
Explanation:
C is correct because the DHCP server used the incorrect option type for the FortiManager IP address. The option type should be 43 instead of 15, as shown in the FortiManager Administration Guide under Zero-Touch Provisioning > Configuring DHCP options for ZTP. References: https://docs.fortinet.com/document/fortimanager/7.4.0/administration-guide/568591/high-availability https://docs.fortinet.com/document/fortimanager/7.4.0/administration-guide/568591/high-availability/568592/configuring-ha-options
NEW QUESTION # 18
A remote IT Team is in the process of deploying a FortiGate in their lab. The closed environment has been configured to support zero-touch provisioning from the FortiManager, on the same network, via DHCP options. After waiting 15 minutes, they are reporting that the FortiGate received an IP address, but the zero-touch process failed.
The exhibit below shows what the IT Team provided while troubleshooting this issue:
Which statement explains why the FortiGate did not install its configuration from the FortiManager?
- A. The DHCP server was not configured with the FQDN of the FortiManager
- B. The configuration was modified on the FortiGate prior to connecting to the FortiManager
- C. The DHCP server used the incorrect option type for the FortiManager IP address.
- D. The FortiGate was not configured with the correct pre-shared key to connect to the FortiManager
Answer: C
Explanation:
C is correct because the DHCP server used the incorrect option type for the FortiManager IP address. The option type should be 43 instead of 15, as shown in the FortiManager Administration Guide under Zero-Touch Provisioning > Configuring DHCP options for ZTP. Reference: https://docs.fortinet.com/document/fortimanager/7.4.0/administration-guide/568591/high-availability https://docs.fortinet.com/document/fortimanager/7.4.0/administration-guide/568591/high-availability/568592/configuring-ha-options
NEW QUESTION # 19
SD-WAN is configured on a FortiGate. You notice that when one of the internet links has high latency the time to resolve names using DNS from FortiGate is very high.
You must ensure that the FortiGate DNS resolution times are as low as possible with the least amount of work.
What should you configure?
- A. Configure two DNS servers and use DNS servers recommended by the two internet providers.
- B. Configure local out traffic to use the outgoing interface based on SD-WAN rules with the interface IP and configure an SD-WAN rule to the DNS server.
- C. Configure local out traffic to use the outgoing interface based on SD-WAN rules with a manual defined IP associated to a loopback interface and configure an SD-WAN rule from the loopback to the DNS server.
- D. Configure an SD-WAN rule to the DNS server and use the FortiGate interface IPs in the source address.
Answer: B
Explanation:
SD-WAN is a feature that allows users to optimize network performance and reliability by using multiple WAN links and applying rules based on various criteria, such as latency, jitter, packet loss, etc. One way to ensure that the FortiGate DNS resolution times are as low as possible with the least amount of work is to configure local out traffic to use the outgoing interface based on SD-WAN rules with the interface IP and configure an SD-WAN rule to the DNS server. This means that the FortiGate will use the best WAN link available to send DNS queries to the DNS server according to the SD-WAN rule, and use its own interface IP as the source address. This avoids NAT issues and ensures optimal DNS performance. References: https://docs.fortinet.com/document/fortigate/7.0.0/sd-wan/19662/sd-wan
NEW QUESTION # 20
Refer to the exhibit.
A customer has deployed a FortiGate 200F high-availability (HA) cluster that contains & TPM chip. The exhibit shows output from the FortiGate CLI session where the administrator enabled TPM.
Following these actions, the administrator immediately notices that both FortiGate high availability (HA) status and FortiManager status for the FortiGate are negatively impacted.
What are the two reasons for this behavior? (Choose two.)
- A. Configuration for TPM is not synchronized between FortiGate HA cluster members.
- B. The FortiGate has not finished the auto-update process to synchronize the new configuration to FortiManager yet.
- C. TPM functionality is not yet compatible with FortiGate HA D The administrator needs to manually enter the hex private data encryption key in FortiManager
- D. The private-data-encryption key entered on the primary did not match the value that the TPM expected.
Answer: A,D
Explanation:
The two reasons for the negative impact on the FortiGate HA status and FortiManager status after enabling TPM are:
The private-data-encryption key entered on the primary unit did not match the value that the TPM expected. This could happen if the TPM was previously enabled and then disabled, and the key was changed in between. The TPM will reject the new key and cause an error in the configuration synchronization.
Configuration for TPM is not synchronized between FortiGate HA cluster members. Each cluster member must have the same private-data-encryption key to form a valid HA cluster and synchronize their configurations. However, enabling TPM on one unit does not automatically enable it on the other units, and the key must be manually entered on each unit. To resolve these issues, the administrator should disable TPM on all units, clear the TPM data, and then enable TPM again with the same private-data-encryption key on each unit. Reference: https://docs.fortinet.com/document/fortigate/6.4.0/cookbook/103437/inbound-ssl-inspection https://docs.fortinet.com/document/fortigate/6.4.0/cookbook/103438/application-detection-on-ssl-offloaded-traffic
NEW QUESTION # 21
Refer to the CLI configuration of an SSL inspection profile from a FortiGate device configured to protect a web server:
Based on the information shown, what is the expected behavior when an HTTP/2 request comes in?
- A. FortiGate will reject all HTTP/2 ALPN headers.
- B. FortiGate will strip the ALPN header and forward the traffic.
- C. FortiGate will rewrite the ALPN header to request HTTP/1.
- D. FortiGate will forward the traffic without modifying the ALPN header.
Answer: A
Explanation:
The supported-alpn parameter is set to http1.1 in the SSL inspection profile. This means that the FortiGate will only accept HTTP/1.1 traffic. Any HTTP/2 traffic will be rejected.
The following is the relevant documentation from Fortinet:
The supported-alpn parameter specifies the list of ALPN protocols that the FortiGate will accept. If the client requests a protocol that is not in this list, the FortiGate will reject the connection.
The default value for the supported-alpn parameter is all. This means that the FortiGate will accept any ALPN protocol that the client requests.
To reject all HTTP/2 traffic, set the supported-alpn parameter to http1.1.
Source: https://docs.fortinet.com/document/fortigate/7.0.0/new-features/710924/http-2-support-in-proxy-mode-ssl-inspection
NEW QUESTION # 22
A customer is planning on moving their secondary data center to a cloud-based laaS. They want to place all the Oracle-based systems Oracle Cloud, while the other systems will be on Microsoft Azure with ExpressRoute service to their main data center.
They have about 200 branches with two internet services as their only WAN connections. As a security consultant you are asked to design an architecture using Fortinet products with security, redundancy and performance as a priority.
Which two design options are true based on these requirements? (Choose two.)
- A. Use FortiGate VM for IPSEC over ExpressRoute, as traffic is not encrypted by Azure.
- B. Systems running on Azure will need to go through the main data center to access the services on Oracle Cloud.
- C. Two ExpressRoute services to the main data center are required to implement SD-WAN between a FortiGate VM in Azure and a FortiGate device at the data center edge
- D. Branch FortiGate devices must be configured as VPN clients for the branches' internal network to be able to access Oracle services without using public IPs.
Answer: A,C
Explanation:
To secure the traffic between Azure and the main data center, a FortiGate VM can be deployed in Azure and configured to use IPSEC over ExpressRoute, as traffic is not encrypted by Azure by default. This also allows the use of Fortinet security features such as antivirus, IPS, web filtering, and application control. To implement SD-WAN between Azure and the main data center, two ExpressRoute services are required to provide redundant paths and load balancing. A FortiGate device at the data center edge can be configured to use SD-WAN rules to select the best path based on performance, availability, and cost. Reference: https://docs.fortinet.com/document/fortigate/6.4.0/cookbook/103440/ipsec-vpn-between-fortigate-and-azure https://docs.fortinet.com/document/fortigate/6.4.0/cookbook/103441/sd-wan-between-fortigate-and-azure
NEW QUESTION # 23
Review the VPN configuration shown in the exhibit.
What is the Forward Error Correction behavior if the SD-WAN network traffic download is 500 Mbps and has 8% of packet loss in the environment?
- A. 1 redundant packet for every 10 base packets
- B. 2 redundant packet for every 8 base packets
- C. 3 redundant packet for every 9 base packets
- D. 3 redundant packet for every 5 base packets
Answer: D
Explanation:
Forward Error Correction (FEC) is a feature that can improve the quality of SD-WAN network traffic by adding redundant packets to the original packets. The ratio of redundant packets to base packets is determined by the FEC mode, which can be set to low, medium, or high. In low mode, the ratio is 1:10, in medium mode, the ratio is 2:8, and in high mode, the ratio is 3:5. The FEC mode can be configured manually or automatically based on the bandwidth and packet loss of the network. In this case, since the download bandwidth is 500 Mbps and the packet loss is 8%, the FEC mode is automatically set to high, which means that 3 redundant packets are added for every 5 base packets. Reference: https://docs.fortinet.com/document/fortigate/7.0.0/sd-wan/19662/forward-error-correction-fec
NEW QUESTION # 24
A customer with a FortiDDoS 200F protecting their fibre optic internet connection from incoming traffic sees that all the traffic was dropped by the device even though they were not under a DoS attack. The traffic flow was restored after it was rebooted using the GUI. Which two options will prevent this situation in the future? (Choose two)
- A. Move the internet connection from the SFP interfaces to the LC interfaces
- B. Change the Adaptive Mode.
- C. Replace with a FortiDDoS 1500F
- D. Create an HA setup with a second FortiDDoS 200F
Answer: C,D
Explanation:
B is correct because creating an HA setup with a second FortiDDoS 200F will provide redundancy in case one of the devices fails. This will prevent all traffic from being dropped in the event of a failure.
D is correct because the FortiDDoS 1500F has a larger throughput capacity than the FortiDDoS 200F. This means that it will be less likely to drop traffic even under heavy load.
The other options are incorrect. Option A is incorrect because changing the Adaptive Mode will not prevent the device from dropping traffic. Option C is incorrect because moving the internet connection from the SFP interfaces to the LC interfaces will not change the throughput capacity of the device.
References:
FortiDDoS 200F Datasheet | Fortinet Document Library
FortiDDoS 1500F Datasheet | Fortinet Document Library
High Availability (HA) on FortiDDoS | FortiDDoS / FortiOS 7.0.0 - Fortinet Document Library
NEW QUESTION # 25
Refer to the exhibit, which shows a VPN topology.
The device IP 10.1.100.40 downloads a file from the FTP server IP 192.168.4.50 Referring to the exhibit, what will be the traffic flow behavior if ADVPN is configured in this environment?
- A. Spoke1 will establish an ADVPN shortcut to Spoke2
- B. ADVPN is not supported when spokes are behind NAT
- C. All the session traffic will pass through the Hub
- D. The TCP port 21 must be allowed on the NAT Device2
Answer: A
Explanation:
D is correct because Spoke1 will establish an ADVPN shortcut to Spoke2 when it detects that there is a demand for traffic between them. This is explained in the Fortinet Community article on Technical Tip: Fortinet Auto Discovery VPN (ADVPN) under Summary - ADVPN sequence of events. Reference: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Fortinet-Auto-Discovery-VPN-ADVPN/ta-p/195698
NEW QUESTION # 26
Refer to the exhibits.
A customer has deployed a FortiGate with iBGP and eBGP routing enabled. HQ is receiving routes over eBGP from ISP 2; however, only certain routes are showing up in the routing table-Assume that BGP is working perfectly and that the only possible modifications to the routing table are solely due to the prefix list that is applied on HQ.
Given the exhibits, which two routes will be active in the routing table on the HQ firewall? (Choose two.)
- A. 172,620,64,27
- B. 172.16.204.64/27
- C. 172.16.204.128/25
- D. 172.16.201.96/29
Answer: B,C
Explanation:
The prefix list in the exhibit is configured to match prefixes that are either in the 172.16.204.0/24 subnet or in the 172.62.0.0/16 subnet. The routes that match these prefixes will be active in the routing table on the HQ firewall.
The routes that match the following prefixes will not be active in the routing table:
172.16.201.96/29
172.62.0.64/27
These routes do not match the criteria set by the prefix list.
References:
Prefix lists | FortiGate / FortiOS 7.4.0 - Fortinet Document Library
Configuring BGP | FortiGate / FortiOS 7.4.0 - Fortinet Document Library
NEW QUESTION # 27
A remote worker requests access to an SSH server inside the network. You deployed a ZTNA Rule to their FortiClient. You need to follow the security requirements to inspect this traffic.
Which two statements are true regarding the requirements? (Choose two.)
- A. Traffic is discarded as ZTNA does not support SSH connection rules
- B. FortiGate can perform SSH access proxy host-key validation.
- C. SSH traffic is tunneled between the client and the access proxy over HTTPS
- D. You need to configure a FortiClient SSL-VPN tunnel to inspect the SSH traffic.
Answer: B,C
Explanation:
ZTNA supports SSH connection rules that allow remote workers to access SSH servers inside the network through an HTTPS tunnel between the client and the access proxy (FortiGate). The access proxy acts as an SSH client to connect to the real SSH server on behalf of the user, and performs host-key validation to verify the identity of the server. The user can use any SSH client that supports HTTPS proxy settings, such as PuTTY or OpenSSH. Reference: https://docs.fortinet.com/document/fortigate/7.0.0/ztna-deployment/899992/configuring-ztna-rules-to-control-access
NEW QUESTION # 28
Refer to the CLI output:
Given the information shown in the output, which two statements are correct? (Choose two.)
- A. Reputation from blacklisted IP addresses from DHCP or PPPoE pools can be restored
- B. Attackers can be blocked before they target the servers behind the FortiWeb.
- C. Geographical IP policies are enabled and evaluated after local techniques.
- D. The IP Reputation feature has been manually updated
- E. An IP address that was previously used by an attacker will always be blocked
Answer: A,B
Explanation:
The CLI output shown in the exhibit indicates that FortiWeb has enabled IP Reputation feature with local techniques enabled and geographical IP policies enabled after local techniques (set geoip-policy-order after-local). IP Reputation feature is a feature that allows FortiWeb to block or allow traffic based on the reputation score of IP addresses, which reflects their past malicious activities or behaviors. Local techniques are methods that FortiWeb uses to dynamically update its own blacklist based on its own detection of attacks or violations from IP addresses (such as signature matches, rate limiting, etc.). Geographical IP policies are rules that FortiWeb uses to block or allow traffic based on the geographical location of IP addresses (such as country, region, city, etc.). Therefore, based on the output, one correct statement is that attackers can be blocked before they target the servers behind the FortiWeb. This is because FortiWeb can use IP Reputation feature to block traffic from IP addresses that have a low reputation score or belong to a blacklisted location, which prevents them from reaching the servers and launching attacks. Another correct statement is that reputation from blacklisted IP addresses from DHCP or PPPoE pools can be restored. This is because FortiWeb can use local techniques to remove IP addresses from its own blacklist if they stop sending malicious traffic for a certain period of time (set local-techniques-expire-time), which allows them to regain their reputation and access the servers. This is useful for IP addresses that are dynamically assigned by DHCP or PPPoE and may change frequently. Reference: https://docs.fortinet.com/document/fortiweb/6.4.0/administration-guide/19662/ip-reputation https://docs.fortinet.com/document/fortiweb/6.4.0/administration-guide/19662/geographical-ip-policies
NEW QUESTION # 29
Refer to the exhibit.
A customer wants FortiClient EMS configured to deploy to 1500 endpoints. The deployment will be integrated with FortiOS and there is an Active Directory server.
Given the configuration shown in the exhibit, which two statements about the installation are correct? (Choose two.)
- A. You can only deploy initial installations to Windows clients.
- B. If no client update time is specified on EMS, the user will be able to choose the time of installation if they wish to delay.
- C. You must use Standard or Enterprise SQL Server rather than the included SQL Server Express
- D. A client can be eligible for multiple enabled configurations on the EMS server, and one will be chosen based on first priority
- E. The Windows clients only require "File and Printer Sharing0 allowed and the rest is handled by Active Directory group policy
Answer: B,E
Explanation:
A is correct because if no client update time is specified on EMS, the user will be able to choose the time of installation if they wish to delay. This is because the FortiClient EMS server will not force the installation on the client.
E is correct because the Windows clients only require "File and Printer Sharing" allowed and the rest is handled by Active Directory group policy. This is because the Active Directory group policy will configure the Windows clients to automatically install FortiClient and the FortiClient EMS server will only need to push the initial configuration to the clients.
The other options are incorrect. Option B is incorrect because a client can only be eligible for one enabled configuration on the EMS server. Option C is incorrect because you can deploy initial installations to both Windows and macOS clients. Option D is incorrect because you can use the included SQL Server Express to deploy FortiClient EMS.
References:
Deploying FortiClient EMS | FortiClient / FortiOS 7.4.0 - Fortinet Document Library Configuring FortiClient EMS | FortiClient / FortiOS 7.4.0 - Fortinet Document Library FortiClient EMS installation requirements | FortiClient / FortiOS 7.4.0 - Fortinet Document Library
NEW QUESTION # 30
......
NSE8_812 Exam Dumps For Certification Exam Preparation: https://www.exam4pdf.com/NSE8_812-dumps-torrent.html
100% Pass Guaranteed Download Fortinet Network Security Expert Exam PDF Q&A: https://drive.google.com/open?id=1gHuIblzy-_sy8_nBraLOxIWxkjJNqTRZ
