• Home
  • Articles
  • 2023 NSE8_812 Dumps PDF - NSE8_812 Real Exam Questions Answers [Q11-Q33]

2023 NSE8_812 Dumps PDF - NSE8_812 Real Exam Questions Answers [Q11-Q33]

Share

2023 NSE8_812 Dumps PDF - NSE8_812 Real Exam Questions Answers

Valid NSE8_812 Test Answers & Fortinet NSE8_812 Exam PDF

NEW QUESTION # 11
Refer to the exhibits.

A customer has deployed a FortiGate with iBGP and eBGP routing enabled. HQ is receiving routes over eBGP from ISP 2; however, only certain routes are showing up in the routing table-Assume that BGP is working perfectly and that the only possible modifications to the routing table are solely due to the prefix list that is applied on HQ.
Given the exhibits, which two routes will be active in the routing table on the HQ firewall? (Choose two.)

  • A. 172.16.201.96/29
  • B. 172,620,64,27
  • C. 172.16.204.64/27
  • D. 172.16.204.128/25

Answer: B,D

Explanation:
A is correct because 172.16.204.128/25 matches the prefix list entry 172.16.204.0/24 ge 25 le 25. C is correct because 172.16.204.64/27 matches the prefix list entry 172.16.204.0/24 ge 27 le 27. Reference: https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/978793/bgp


NEW QUESTION # 12
Refer to the exhibit showing a FortiSOAR playbook.

You are investigating a suspicious e-mail alert on FortiSOAR, and after reviewing the executed playbook, you can see that it requires intervention.
What should be your next step?

  • A. Reply to the e-mail with the requested Playbook action
  • B. Click on the notification icon on FortiSOAR GUI and run the pending input action
  • C. Run the Mark Drive by Download playbook action
  • D. Go to the Incident Response tasks dashboard and run the pending actions

Answer: B

Explanation:
To intervene in a suspicious e-mail alert on FortiSOAR, after reviewing the executed playbook, the next step is to click on the notification icon on FortiSOAR GUI and run the pending input action. The notification icon will show a badge with the number of pending input actions that require manual intervention from the user. The user can click on the notification icon and see a list of pending input actions, along with their details, such as playbook name, step name, record ID, and trigger time. The user can then click on the Run button to execute the pending input action and resume the playbook execution. Reference: https://docs.fortinet.com/document/fortisoar/7.0.0/administration-guide/103440/automation-stitches https://docs.fortinet.com/document/fortisoar/7.0.0/administration-guide/103441/incoming-webhook


NEW QUESTION # 13
Refer to the exhibit containing the configuration snippets from the FortiGate. Customer requirements:

* SSLVPN Portal must be accessible on standard HTTPS port (TCP/443)
* Public IP address (129.11.1.100) is assigned to portl
* Datacenter.acmecorp.com resolves to the public IP address assigned to portl The customer has a Let's Encrypt certificate that is going to expire soon and it reports that subsequent attempts to renew that certificate are failing.
Reviewing the requirement and the exhibit, which configuration change below will resolve this issue?
A)

B)

C)

  • A. Option A
  • B. Option B
  • C. Option D
  • D. Option C

Answer: D

Explanation:
To resolve the issue of failing to renew the Let's Encrypt certificate, the configuration change that is needed is to enable the HTTP-to-HTTPS redirect option in the SSL-VPN settings. This option allows the FortiGate to redirect HTTP requests to HTTPS port 443, which is required for Let's Encrypt to validate the domain ownership and issue a new certificate. By enabling this option, the FortiGate will be able to respond to the HTTP challenge from Let's Encrypt and renew the certificate successfully. Reference: https://docs.fortinet.com/document/fortigate/6.4.0/cookbook/103437/inbound-ssl-inspection https://docs.fortinet.com/document/fortigate/6.4.0/cookbook/103438/application-detection-on-ssl-offloaded-traffic


NEW QUESTION # 14
Refer to the exhibits.
Exhibit A

Exhibit B

Exhibit C

A customer is trying to set up a VPN with a FortiGate, but they do not have a backup of the configuration. Output during a troubleshooting session is shown in the exhibits A and B and a baseline VPN configuration is shown in Exhibit C Referring to the exhibits, which configuration will restore VPN connectivity?

  • A.
  • B.
  • C.
  • D.

Answer: A

Explanation:
The VPN configuration shown in Exhibit C is a baseline VPN configuration that uses IKEv2 with pre-shared keys and AES256 encryption for both IKE and ESP phases. However, this configuration does not match the output shown in Exhibit A and B, which indicate that IKEv1 is used with RSA signatures and AES128 encryption for both IKE and ESP phases. Therefore, to restore VPN connectivity, the configuration needs to be modified to match these parameters. Option B shows the correct configuration that matches these parameters. Option A is incorrect because it still uses IKEv2 instead of IKEv1. Option C is incorrect because it still uses pre-shared keys instead of RSA signatures. Option D is incorrect because it still uses AES256 encryption instead of AES128 encryption. Reference: https://docs.fortinet.com/document/fortigate/7.0.0/cookbook/19662/ipsec-vpn-with-forticlient


NEW QUESTION # 15
Refer to the exhibit.

A customer has deployed a FortiGate 200F high-availability (HA) cluster that contains & TPM chip. The exhibit shows output from the FortiGate CLI session where the administrator enabled TPM.
Following these actions, the administrator immediately notices that both FortiGate high availability (HA) status and FortiManager status for the FortiGate are negatively impacted.
What are the two reasons for this behavior? (Choose two.)

  • A. The FortiGate has not finished the auto-update process to synchronize the new configuration to FortiManager yet.
  • B. The private-data-encryption key entered on the primary did not match the value that the TPM expected.
  • C. TPM functionality is not yet compatible with FortiGate HA D The administrator needs to manually enter the hex private data encryption key in FortiManager
  • D. Configuration for TPM is not synchronized between FortiGate HA cluster members.

Answer: B,D

Explanation:
The two reasons for the negative impact on the FortiGate HA status and FortiManager status after enabling TPM are:
The private-data-encryption key entered on the primary unit did not match the value that the TPM expected. This could happen if the TPM was previously enabled and then disabled, and the key was changed in between. The TPM will reject the new key and cause an error in the configuration synchronization.
Configuration for TPM is not synchronized between FortiGate HA cluster members. Each cluster member must have the same private-data-encryption key to form a valid HA cluster and synchronize their configurations. However, enabling TPM on one unit does not automatically enable it on the other units, and the key must be manually entered on each unit. To resolve these issues, the administrator should disable TPM on all units, clear the TPM data, and then enable TPM again with the same private-data-encryption key on each unit. Reference: https://docs.fortinet.com/document/fortigate/6.4.0/cookbook/103437/inbound-ssl-inspection https://docs.fortinet.com/document/fortigate/6.4.0/cookbook/103438/application-detection-on-ssl-offloaded-traffic


NEW QUESTION # 16
Refer to the exhibits.

The exhibits show a FortiGate network topology and the output of the status of high availability on the FortiGate.
Given this information, which statement is correct?

  • A. FGVMEVLQOG33WM3D and FGVMEVGCJNHFYI4A share a virtual MAC address.
  • B. The cluster mode can support a maximum of four (4) FortiGate VMs
  • C. The cluster members are on the same network and the IP addresses were statically assigned.
  • D. The ethertype values of the HA packets are 0x8890, 0x8891, and 0x8892

Answer: A

Explanation:
The output of the status of high availability on the FortiGate shows that the cluster mode is active-passive, which means that only one FortiGate unit is active at a time, while the other unit is in standby mode. The active unit handles all traffic and also sends HA heartbeat packets to monitor the standby unit. The standby unit becomes active if it stops receiving heartbeat packets from the active unit, or if it receives a higher priority from another cluster unit. In active-passive mode, all cluster units share a virtual MAC address for each interface, which is used as the source MAC address for all packets forwarded by the cluster. Reference: https://docs.fortinet.com/document/fortigate/6.4.0/cookbook/103439/high-availability-with-two-fortigates


NEW QUESTION # 17
Refer to the exhibit.

You have deployed a security fabric with three FortiGate devices as shown in the exhibit. FGT_2 has the following configuration:

FGT_1 and FGT_3 are configured with the default setting. Which statement is true for the synchronization of fabric-objects?

  • A. Objects from the root FortiGate will only be synchronized to FGT__2.
  • B. Objects from the FortiGate FGT_2 will be synchronized to the upstream FortiGate.
  • C. Objects from the root FortiGate will not be synchronized to any downstream FortiGate.
  • D. Objects from the root FortiGate will only be synchronized to FGT_3.

Answer: B

Explanation:
The security fabric shown in the exhibit consists of three FortiGate devices connected in a hierarchical topology, where FGT_1 is the root device, FGT_2 is a downstream device, and FGT_3 is a downstream device of FGT_2. FGT_2 has a configuration setting that enables fabric-object synchronization for all objects except firewall policies and firewall policy packages (set sync-fabric-objects enable). Fabric-object synchronization is a feature that allows downstream devices to synchronize their objects (such as addresses, services, schedules, etc.) with their upstream devices in a security fabric. This simplifies object management and ensures consistency across devices. Therefore, in this case, objects from FGT_2 will be synchronized to FGT_1 (the upstream device), but not to FGT_3 (the downstream device). Objects from FGT_1 will not be synchronized to any downstream device because the default setting for fabric-object synchronization is disabled. Objects from FGT_3 will not be synchronized to any device because it does not have fabric-object synchronization enabled. Reference: https://docs.fortinet.com/document/fortigate/7.0.0/administration-guide/19662/fabric-object-synchronization


NEW QUESTION # 18
Refer to the exhibit, which shows a Branch1 configuration and routing table.

In the SD-WAN implicit rule, you do not want the traffic load balance for the overlay interface when all members are available.
In this scenario, which configuration change will meet this requirement?

  • A. Change the load-balance-mode to source-ip-based.
  • B. Configure the cost in each overlay member to 10.
  • C. Configure the priority in each overlay member to 10.
  • D. Create a new static route with the internet sdwan-zone only

Answer: B

Explanation:
The SD-WAN implicit rule is a default rule that applies to all traffic that does not match any explicit SD-WAN rule. The SD-WAN implicit rule uses the best quality strategy, which selects the SD-WAN member with the best measured quality based on the performance SLA metrics. This means that the traffic load balance for the overlay interface will depend on the quality of each overlay member, which may vary over time. However, if the requirement is to minimize the overhead on the device for WAN traffic and avoid load balancing for the overlay interface when all members are available, one option is to configure the cost in each overlay member to 10. The cost is a parameter that can be used to influence the selection of an SD-WAN member by adding a penalty value to its quality score. By configuring the same cost value for all overlay members, the quality score of each member will be reduced by the same amount, which will make them less preferable than the underlay members. This way, the SD-WAN implicit rule will select the underlay members first, unless they are unavailable or out of SLA, and only use the overlay members as a backup option. Reference: https://docs.fortinet.com/document/fortigate/7.0.0/sd-wan/19662/sd-wan-rules


NEW QUESTION # 19
Refer to the exhibit showing FortiGate configurations

FortiManager VM high availability (HA) is not functioning as expected after being added to an existing deployment.
The administrator finds that VRRP HA mode is selected, but primary and secondary roles are greyed out in the GUI The managed devices never show online when FMG-B becomes primary, but they will show online whenever the FMG-A becomes primary.
What change will correct HA functionality in this scenario?

  • A. Unset the primary and secondary roles in the FortiManager CLI configuration so VRRP will decide who is primary.
  • B. Make the monitored IP to match on both FortiManager devices.
  • C. Change the priority of FMG-A to be numerically lower for higher preference
  • D. Change the FortiManager IP address on the managed FortiGate to 10.3.106.65.

Answer: B

Explanation:
B is correct because the monitored IP must match on both FortiManager devices for HA to function properly. This is explained in the FortiManager Administration Guide under High Availability > Configuring HA options > Configuring HA options using the GUI. Reference: https://docs.fortinet.com/document/fortimanager/7.4.0/administration-guide/568591/high-availability https://docs.fortinet.com/document/fortimanager/7.4.0/administration-guide/568591/high-availability/568592/configuring-ha-options


NEW QUESTION # 20
You are migrating the branches of a customer to FortiGate devices. They require independent routing tables on the LAN side of the network.
After reviewing the design, you notice the firewall will have many BGP sessions as you have two data centers (DC) and two ISPs per DC while each branch is using at least 10 internal segments.
Based on this scenario, what would you suggest as the more efficient solution, considering that in the future the number of internal segments, DCs or internet links per DC will increase?

  • A. Acquire a FortiGate model with more capacity, considering the next 5 years growth.
  • B. No change in design is needed as even small FortiGate devices have a large memory capacity.
  • C. Implement network-id, neighbor-group and increase the advertisement-interval
  • D. Redesign the SD-WAN deployment to only use a single VPN tunnel and segment traffic using VRFs on BGP

Answer: D

Explanation:
Using multiple VPN tunnels and BGP sessions for each internal segment is not scalable and efficient, especially when the number of segments, DCs or internet links per DC increases. A better solution is to use a single VPN tunnel per branch and segment traffic using virtual routing and forwarding (VRF) instances on BGP. This way, each VRF can have its own routing table and BGP session, while sharing the same VPN tunnel. References: https://docs.fortinet.com/document/fortigate/6.4.0/cookbook/103439/sd-wan-with-vrf-and-bgp


NEW QUESTION # 21
A remote IT Team is in the process of deploying a FortiGate in their lab. The closed environment has been configured to support zero-touch provisioning from the FortiManager, on the same network, via DHCP options. After waiting 15 minutes, they are reporting that the FortiGate received an IP address, but the zero-touch process failed.
The exhibit below shows what the IT Team provided while troubleshooting this issue:

Which statement explains why the FortiGate did not install its configuration from the FortiManager?

  • A. The DHCP server was not configured with the FQDN of the FortiManager
  • B. The DHCP server used the incorrect option type for the FortiManager IP address.
  • C. The configuration was modified on the FortiGate prior to connecting to the FortiManager
  • D. The FortiGate was not configured with the correct pre-shared key to connect to the FortiManager

Answer: B

Explanation:
C is correct because the DHCP server used the incorrect option type for the FortiManager IP address. The option type should be 43 instead of 15, as shown in the FortiManager Administration Guide under Zero-Touch Provisioning > Configuring DHCP options for ZTP. References: https://docs.fortinet.com/document/fortimanager/7.4.0/administration-guide/568591/high-availability https://docs.fortinet.com/document/fortimanager/7.4.0/administration-guide/568591/high-availability/568592/configuring-ha-options


NEW QUESTION # 22
Refer to the exhibits.


A customer is looking for a solution to authenticate the clients connected to a hardware switch interface of a FortiGate 400E.
Referring to the exhibits, which two conditions allow authentication to the client devices before assigning an IP address? (Choose two.)

  • A. Devices connected directly to ports 3 and 4 can perform 802 1X authentication.
  • B. Client devices must have 802 1X authentication enabled
  • C. Ports 3 and 4 can be part of different switch interfaces.
  • D. FortiGate devices with NP6 and hardware switch interfaces cannot support 802.1X authentication.

Answer: A,B

Explanation:
The customer wants to deploy a solution to authenticate the clients connected to a hardware switch interface of a FortiGate 400E device. A hardware switch interface is an interface that combines multiple physical interfaces into one logical interface, allowing them to act as a single switch with one IP address and one set of security policies. The customer wants to use 802.1X authentication for this solution, which is a standard protocol for port-based network access control (PNAC) that authenticates clients based on their credentials before granting them access to network resources. One condition that allows authentication to the client devices before assigning an IP address is that devices connected directly to ports 3 and 4 can perform 802.1X authentication. This is because ports 3 and 4 are part of the hardware switch interface named "lan", which has an IP address of 10.10.10.254/24 and an inbound SSL inspection profile named "ssl-inspection". The inbound SSL inspection profile enables the FortiGate device to intercept and inspect SSL/TLS traffic from clients before forwarding it to servers, which allows it to apply security policies and features such as antivirus, web filtering, application control, etc. However, before performing SSL inspection, the FortiGate device needs to authenticate the clients using 802.1X authentication, which requires the clients to send their credentials (such as username and password) to the FortiGate device over a secure EAP (Extensible Authentication Protocol) channel. The FortiGate device then verifies the credentials with an authentication server (such as RADIUS or LDAP) and grants or denies access to the clients based on the authentication result. Therefore, devices connected directly to ports 3 and 4 can perform 802.1X authentication before assigning an IP address. Another condition that allows authentication to the client devices before assigning an IP address is that client devices must have 802.1X authentication enabled. This is because 802.1X authentication is a mutual process that requires both the client devices and the FortiGate device to support and enable it. The client devices must have 802.1X authentication enabled in their network settings, which allows them to initiate the authentication process when they connect to the hardware switch interface of the FortiGate device. The client devices must also have an 802.1X supplicant software installed, which is a program that runs on the client devices and handles the communication with the FortiGate device using EAP messages. The client devices must also have a trusted certificate installed, which is used to verify the identity of the FortiGate device and establish a secure EAP channel. Therefore, client devices must have 802.1X authentication enabled before assigning an IP address. References: https://docs.fortinet.com/document/fortigate/7.0.0/administration-guide/19662/hardware-switch-interfaces https://docs.fortinet.com/document/fortigate/7.0.0/administration-guide/19662/802-1x-authentication


NEW QUESTION # 23
You are responsible for recommending an adapter type for NICs on a FortiGate VM that will run on an ESXi Hypervisor. Your recommendation must consider performance as the main concern, cost is not a factor. Which adapter type for the NICs will you recommend?

  • A. Native ESXi Networking with VMXNET3
  • B. Virtual Function (VF) PCI Passthrough
  • C. Native ESXi Networking with E1000
  • D. Physical Function (PF) PCI Passthrough

Answer: A

Explanation:
The FortiGate VM is a virtual firewall appliance that can run on various hypervisors, such as ESXi, Hyper-V, KVM, etc. The adapter type for NICs on a FortiGate VM determines the performance and compatibility of the network interface cards with the hypervisor and the physical network. There are different adapter types available for NICs on a FortiGate VM, such as E1000, VMXNET3, SR-IOV, etc. If performance is the main concern and cost is not a factor, one option is to use native ESXi networking with VMXNET3 adapter type for NICs on a FortiGate VM that will run on an ESXi hypervisor. VMXNET3 is a paravirtualized network interface card that is optimized for performance in virtual machines and supports features such as multiqueue support, Receive Side Scaling (RSS), Large Receive Offload (LRO), IPv6 offloads, and MSI/MSI-X interrupt delivery. Native ESXi networking means that the FortiGate VM uses the standard virtual switch (vSwitch) or distributed virtual switch (dvSwitch) provided by the ESXi hypervisor to connect to the physical network. This option can provide high performance and compatibility for NICs on a FortiGate VM without requiring additional hardware or software components. References: https://docs.fortinet.com/document/fortigate/7.0.0/vm-installation-for-vmware-esxi/19662/installing-fortigate-vm-on-vmware-esxi https://docs.fortinet.com/document/fortigate/7.0.0/vm-installation-for-vmware-esxi/19662/networking


NEW QUESTION # 24
You must configure an environment with dual-homed servers connected to a pair of FortiSwitch units using an MCLAG.
Multicast traffic is expected in this environment, and you should ensure unnecessary traffic is pruned from links that do not have a multicast listener.
In which two ways must you configure the igmps-f lood-traffic and igmps-flood-report settings? (Choose two.)

  • A. enable on ICL trunks
  • B. enable on the ISL and FortiLink trunks
  • C. disable on ICL trunks
  • D. disable on the ISL and FortiLink trunks

Answer: C,D

Explanation:
A is correct because disabling igmps-flood-traffic and igmps-flood-report on ICL trunks prevents unnecessary multicast traffic from being flooded across the MCLAG cluster members. C is correct because disabling igmps-flood-traffic and igmps-flood-report on the ISL and FortiLink trunks prevents unnecessary multicast traffic from being flooded to other switches or FortiGates that do not have multicast listeners. Reference: https://docs.fortinet.com/document/fortiswitches/6.4.0/administration-guide/381057/multicast-forwarding https://docs.fortinet.com/document/fortiswitches/6.4.0/administration-guide/381057/multicast-forwarding/381058/configuring-multicast-forwarding


NEW QUESTION # 25
You are creating the CLI script to be used on a new SD-WAN deployment You will have branches with a different number of internet connections and want to be sure there is no need to change the Performance SLA configuration in case more connections are added to the branch.
The current configuration is:

Which configuration do you use for the Performance SLA members?

  • A. current configuration already fulfills the requirement
  • B. set members any
  • C. set members all
  • D. set members 0

Answer: C

Explanation:
D is correct because using set members all allows you to apply the Performance SLA configuration to all available interfaces without specifying them individually. This way, you do not need to change the configuration in case more connections are added to the branch. Reference: https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/978793/sd-wan https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/978793/sd-wan/978795/configuring-sd-wan-performance-sla


NEW QUESTION # 26
Refer to the exhibits.

A FortiGate cluster (CL-1) protects a data center hosting multiple web applications. A pair of FortiADC devices are already configured for SSL decryption (FAD-1), and re-encryption (FAD-2). CL-1 must accept unencrypted traffic from FAD-1, perform application detection on the plain-text traffic, and forward the inspected traffic to FAD-2.
The SSL-Offload-App-Detect application list and SSL-Offload protocol options profile are applied to the firewall policy handling the web application traffic on CL-1.
Given this scenario, which two configuration tasks must the administrator perform on CL-1? (Choose two.) A)

B)


  • A. Option A
  • B. Option B
  • C. Option D
  • D. Option C

Answer: B,D

Explanation:
To enable application detection on plain-text traffic that has been decrypted by FortiADC, the administrator must perform two configuration tasks on CL-1:
Enable SSL offloading in the firewall policy and select the SSL-Offload protocol options profile.
Enable application control in the firewall policy and select the SSL-Offload-App-Detect application list. References: https://docs.fortinet.com/document/fortigate/6.4.0/cookbook/103438/application-detection-on-ssl-offloaded-traffic


NEW QUESTION # 27
Refer to the exhibit.

The exhibit shows the forensics analysis of an event detected by the FortiEDR core In this scenario, which statement is correct regarding the threat?

  • A. This is a ransomware attack and has not been stopped by FortiEDR.
  • B. This is an exfiltration attack and has not been stopped by FortiEDR
  • C. This is a ransomware attack and has been stopped by FortiEDR
  • D. This is an exfiltration attack and has been stopped by FortiEDR.

Answer: C

Explanation:
The exhibit shows the forensics analysis of an event detected by the FortiEDR core. The event graph indicates that a process named svchost.exe was launched by a malicious file named 1.exe, which was downloaded from a suspicious URL. The process then attempted to encrypt files in various folders, such as Documents, Pictures, and Desktop, which are typical targets of ransomware attacks. However, FortiEDR was able to stop the process and prevent any file encryption by applying its real-time post-execution prevention feature. Therefore, this is a ransomware attack and has been stopped by FortiEDR. Reference: https://docs.fortinet.com/document/fortiedr/6.0.0/administration-guide/733983/forensics https://www.fortinet.com/content/dam/fortinet/assets/data-sheets/fortiedr.pdf


NEW QUESTION # 28
An automation stitch was configured using an incoming webhook as the trigger named 'my_incoming_webhook'. The action is configured to execute the CLI Script shown:

  • A.
  • B.
  • C.
  • D.

Answer: C

Explanation:
The CLI script in option A will send the log message to the webhook server. The webhook server can then be configured to take any desired action, such as storing the log message in a database or sending an email notification.
The other options are incorrect. Option B will not send the log message to the webhook server because it does not contain the curl command. Option C will send the log message to the webhook server, but it will also include the FortiGate's IP address and MAC address. This information is not necessary, and it could be used by an attacker to identify the FortiGate. Option D will not send the log message to the webhook server because it does not contain the webhook action.
References:
Automation webhook stitches: https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/989735/webhook-action Webhooks: https://en.wikipedia.org/wiki/Webhook


NEW QUESTION # 29
A customer is planning on moving their secondary data center to a cloud-based laaS. They want to place all the Oracle-based systems Oracle Cloud, while the other systems will be on Microsoft Azure with ExpressRoute service to their main data center.
They have about 200 branches with two internet services as their only WAN connections. As a security consultant you are asked to design an architecture using Fortinet products with security, redundancy and performance as a priority.
Which two design options are true based on these requirements? (Choose two.)

  • A. Two ExpressRoute services to the main data center are required to implement SD-WAN between a FortiGate VM in Azure and a FortiGate device at the data center edge
  • B. Branch FortiGate devices must be configured as VPN clients for the branches' internal network to be able to access Oracle services without using public IPs.
  • C. Systems running on Azure will need to go through the main data center to access the services on Oracle Cloud.
  • D. Use FortiGate VM for IPSEC over ExpressRoute, as traffic is not encrypted by Azure.

Answer: A,D

Explanation:
To secure the traffic between Azure and the main data center, a FortiGate VM can be deployed in Azure and configured to use IPSEC over ExpressRoute, as traffic is not encrypted by Azure by default. This also allows the use of Fortinet security features such as antivirus, IPS, web filtering, and application control. To implement SD-WAN between Azure and the main data center, two ExpressRoute services are required to provide redundant paths and load balancing. A FortiGate device at the data center edge can be configured to use SD-WAN rules to select the best path based on performance, availability, and cost. Reference: https://docs.fortinet.com/document/fortigate/6.4.0/cookbook/103440/ipsec-vpn-between-fortigate-and-azure https://docs.fortinet.com/document/fortigate/6.4.0/cookbook/103441/sd-wan-between-fortigate-and-azure


NEW QUESTION # 30
Refer to the exhibit.

A customer has deployed a FortiGate 200F high-availability (HA) cluster that contains & TPM chip. The exhibit shows output from the FortiGate CLI session where the administrator enabled TPM.
Following these actions, the administrator immediately notices that both FortiGate high availability (HA) status and FortiManager status for the FortiGate are negatively impacted.
What are the two reasons for this behavior? (Choose two.)

  • A. The FortiGate has not finished the auto-update process to synchronize the new configuration to FortiManager yet.
  • B. The private-data-encryption key entered on the primary did not match the value that the TPM expected.
  • C. TPM functionality is not yet compatible with FortiGate HA D The administrator needs to manually enter the hex private data encryption key in FortiManager
  • D. Configuration for TPM is not synchronized between FortiGate HA cluster members.

Answer: B,D

Explanation:
The two reasons for the negative impact on the FortiGate HA status and FortiManager status after enabling TPM are:
The private-data-encryption key entered on the primary unit did not match the value that the TPM expected. This could happen if the TPM was previously enabled and then disabled, and the key was changed in between. The TPM will reject the new key and cause an error in the configuration synchronization.
Configuration for TPM is not synchronized between FortiGate HA cluster members. Each cluster member must have the same private-data-encryption key to form a valid HA cluster and synchronize their configurations. However, enabling TPM on one unit does not automatically enable it on the other units, and the key must be manually entered on each unit. To resolve these issues, the administrator should disable TPM on all units, clear the TPM data, and then enable TPM again with the same private-data-encryption key on each unit. References: https://docs.fortinet.com/document/fortigate/6.4.0/cookbook/103437/inbound-ssl-inspection https://docs.fortinet.com/document/fortigate/6.4.0/cookbook/103438/application-detection-on-ssl-offloaded-traffic


NEW QUESTION # 31
You are running a diagnose command continuously as traffic flows through a platform with NP6 and you obtain the following output:

Given the information shown in the output, which two statements are true? (Choose two.)

  • A. Enable HPE shaper for the NP6 will change the output
  • B. There are packet drops at the XAUI.
  • C. The output is showing a packet descriptor queue accumulated counter
  • D. Host-shortcut mode is enabled.
  • E. Enabling bandwidth control between the ISF and the NP will change the output

Answer: B,C

Explanation:
The diagnose command shown in the output is used to display information about NP6 packet descriptor queues. The output shows that there are 16 NP6 units in total, and each unit has four XAUI ports (XA0-XA3). The output also shows that there are some non-zero values in the columns PDQ ACCU (packet descriptor queue accumulated counter) and PDQ DROP (packet descriptor queue drop counter). These values indicate that there are some packet descriptor queues that have reached their maximum capacity and have dropped some packets at the XAUI ports. This could be caused by congestion or misconfiguration of the XAUI ports or the ISF (Internal Switch Fabric). References: https://docs.fortinet.com/document/fortigate/7.0.0/cli-reference/19662/diagnose-np6-pdq The output is showing a packet descriptor queue accumulated counter, which is a measure of the number of packets that have been dropped by the NP6 due to congestion. The counter will increase if there are more packets than the NP6 can handle, which can happen if the bandwidth between the ISF and the NP is not sufficient or if the HPE shaper is enabled.
The output also shows that there are packet drops at the XAUI, which is the interface between the NP6 and the FortiGate's backplane. This means that the NP6 is not able to keep up with the traffic and is dropping packets.
The other statements are not true. Host-shortcut mode is not enabled, and enabling bandwidth control between the ISF and the NP will not change the output. HPE shaper is a feature that can be enabled to improve performance, but it will not change the output of the diagnose command.


NEW QUESTION # 32
Refer to the exhibits.

The exhibits show a FortiMail network topology, Inbound configuration settings, and a Dictionary Profile.
You are required to integrate a third-party's host service (srv.thirdparty.com) into the e-mail processing path.
All inbound e-mails must be processed by FortiMail antispam and antivirus with FortiSandbox integration. If the email is clean, FortiMail must forward it to the third-party service, which will send the email back to FortiMail for final delivery, FortiMail must not scan the e-mail again.
Which three configuration tasks must be performed to meet these requirements? (Choose three.)

  • A. Change the scan order in FML-GW to antispam-sandbox-content.
  • B. Create an access receive rule with a Sender value of srv. thirdparcy.com, Recipient value of *@acme.com, and action value of Safe
  • C. Create an IP policy with a Source value of 100. 64 .0.72/32, enable precedence, and place the policy at the top of the list.
  • D. Apply the Catch-AII profile to the ASinbound profile and configure an access delivery rule to deliver to the 100.64.0.72 host.
  • E. Apply the Catch-Ail profile to the CFInbound profile and configure a content action profile to deliver to the srv. thirdparty. com FQDN

Answer: A,C,E

Explanation:
A is correct because the scan order must be changed to antispam-sandbox-content in order for FortiMail to scan the email for spam and viruses before forwarding it to the third-party service.
B is correct because the Catch-All profile must be applied to the CFInbound profile in order for FortiMail to forward clean emails to the third-party service.
E is correct because an IP policy must be created with a Source value of 100.64.0.72/32 in order to allow emails from the third-party service to be delivered to FortiMail.
The other options are not necessary to meet the requirements. Option C is not necessary because the access receive rule will already allow emails from the third-party service to be received by FortiMail. Option D is not necessary because the Catch-All profile already allows emails to be delivered to any destination.
Here are some additional details about integrating a third-party service into the FortiMail email processing path:
The third-party service must be able to receive emails from FortiMail and send them back to FortiMail.
The third-party service must be able to communicate with FortiMail using the SMTP protocol.
The third-party service must be able to authenticate with FortiMail using the SMTP AUTH protocol.
Once the third-party service is integrated into the FortiMail email processing path, all inbound emails will be processed by FortiMail as usual. If the email is clean, FortiMail will forward it to the third-party service. The third-party service will then send the email back to FortiMail for final delivery. FortiMail will not scan the email again.


NEW QUESTION # 33
......

NSE8_812 Exam Dumps - PDF Questions and Testing Engine: https://prepcram.pass4guide.com/NSE8_812-dumps-questions.html

Related Articles

more
Fortinet NSE8_812 Certification Practice Exam