Summer Certification Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code = getmirror

Home
Fortinet
Fortinet Network Security Expert
NSE8_812
Network Security Expert 8 Written Exam Questions and Answers

Pass the Fortinet Network Security Expert NSE8_812 Questions and answers with ExamsMirror

Practice at least 50% of the questions to maximize your chances of passing.

Exam NSE8_812 Premium Access

View all detail and faqs for the NSE8_812 exam

Go to Exam

734 Students Passed

92% Average Score

90% Same Questions

Viewing page 2 out of 4 pages

Viewing questions 11-20 out of questions

Questions # 11:

Refer to the exhibit.

Question # 11

You need to create a base SD-WAN configuration that includes SD-WAN rules and Performance SLAs for spoke sites with various connectivity types. It needs to be done in a way that can be easily applied to new sites with a minimum amount of change. How should you create the SD-WAN zones?

Options:

With members and assign overlay interfaces

With members without interface assignments

With no members configured

With members and assign interfaces but do not specify a gateway

Answer

Questions # 12:

A FortiGate running FortiOS 7.2.0 GA is configured in multi-vdom mode with a vdom set to vdom type Admin and another vdom set to vdom type Traffic.

Which two GUI sections are available on both VDOM types? (Choose two.)

Options:

Interface configuration

Packet capture

Security Fabric topology and external connectors

Certificates

FortiClient configuration

Answer

A, B

Questions # 13:

You want to use the MTA adapter feature on FortiSandbox in an HA-Cluster. Which statement about this solution is true?

Options:

The configuration of the MTA Adapter Local Interface is different than on port1.

The MTA adapter is only available in the primary node.

The MTA adapter mode is only detection mode.

The configuration is different than on a standalone device.

Answer

Explanation

The MTA adapter feature on FortiSandbox is a feature that allows FortiSandbox to act as a mail transfer agent (MTA) that can receive, inspect, and forward email messages from external sources. The MTA adapter feature can be used to integrate FortiSandbox with third-party email security solutions that do not support direct integration with FortiSandbox, such as Microsoft Exchange Server or Cisco Email Security Appliance (ESA). The MTA adapter feature can also be used to enhance email security by adding an additional layer of inspection and filtering before delivering email messages to the final destination. The MTA adapter feature can be enabled on FortiSandbox in an HA-Cluster, which is a configuration that allows two FortiSandbox units to synchronize their settings and data and provide high availability and load balancing for sandboxing services. However, one statement about this solution that is true is that the MTA adapter is only available in the primary node. This means that only one FortiSandbox unit in the HA-Cluster can act as an MTA and receive email messages from external sources, while the other unit acts as a backup node that can take over the MTA role if the primary node fails or loses connectivity. This also means that only one IP address or FQDN can be used to configure the external sources to send email messages to the FortiSandbox MTA, which is the IP address or FQDN of the primary node. References: https://docs.fortinet.com/document/fortisandbox/3.2.0/administration-guide/19662/mail-transfer-agent-mta https://docs.fortinet.com/document/fortisandbox/3.2.0/administration-guide/19662/high-availability-ha

https://docs.fortinet.com/document/fortisandbox/4.4.3/administration-guide/877925/mta-adapter

Questions # 14:

You have configured a Site-to-Site IPsec VPN tunnel between a FortiGate and a third-party device but notice that one of the error counters on the tunnel interface keeps increasing.

Question # 14

Which two configuration options can resolve this problem? (Choose two.)

Options:

Enable Forward Error Correction (FEC) on the VPN interface for egress traffic.

Adjust the MTU of the physical interface to which the IPsec tunnel is bound.

Enable DF-bit honoring in the global settings.

Adjust the MTU of the IPsec interface.

Answer

C, D

Questions # 15:

A remote IT Team is in the process of deploying a FortiGate in their lab. The closed environment has been configured to support zero-touch provisioning from the FortiManager, on the same network, via DHCP options. After waiting 15 minutes, they are reporting that the FortiGate received an IP address, but the zero-touch process failed.

The exhibit below shows what the IT Team provided while troubleshooting this issue:

Question # 15

Which statement explains why the FortiGate did not install its configuration from the FortiManager?

Options:

The FortiGate was not configured with the correct pre-shared key to connect to the FortiManager

The DHCP server was not configured with the FQDN of the FortiManager

The DHCP server used the incorrect option type for the FortiManager IP address.

The configuration was modified on the FortiGate prior to connecting to the FortiManager

Answer

Explanation

https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-perform-zero-touch-provisioning-with/ta-p/197623

Questions # 16:

Which two types of interface have built-in active bypass in FortiDDoS devices? (Choose two.)

Options:

SFP

QSFP+

Copper

SFP+

Answer

B, D

Explanation

https://help.fortinet.com/fddos/4-3-0/FortiDDoS/Built_in_bypass.htm

Questions # 17:

What is the benefit of using FortiGate NAC LAN Segments?

Options:

It provides support for multiple DHCP servers within the same VLAN.

It provides physical isolation without changing the IP address of hosts.

It provides support for IGMP snooping between hosts within the same VLAN

It allows for assignment of dynamic address objects matching NAC policy.

Answer

Explanation

FortiGate NAC LAN Segments are a feature that allows users to assign different VLANs to different LAN segments without changing the IP address of hosts or bouncing the switch port. This provides physical isolation while maintaining firewall sessions and avoiding DHCP issues. One benefit of using FortiGate NAC LAN Segments is that it allows for assignment of dynamic address objects matching NAC policy. This means that users can create firewall policies based on dynamic address objects that match the NAC policy criteria, such as device type, OS type, MAC address, etc. This simplifies firewall policy management and enhances security by applying different security profiles to different types of devices.References:https://docs.fortinet.com/document/fortigate/7.0.0/new-features/856212/nac-lan-segments-7-0-1

https://docs.fortinet.com/document/fortigate/7.0.0/new-features/856212/nac-lan-segments-7-0-1

Questions # 18:

Refer to the exhibit that shows VPN debugging output.

Question # 18

The VPN tunnel between headquarters and the branch office is not being established.

What is causing the problem?

Options:

The Phase-1 encryption algorithms are not matching.

There is no matching Diffie-Hellman Group.

HQ is using IKE v1 and the branch office is using with IKE v2.

There is a mismatch in the ISAKMP SA lifetime.

Answer

Questions # 19:

Refer to the exhibits.

Question # 19

During the implementation of a Fortinet Security Fabric configuration, CLI commands were issued in the order shown in the exhibit. On the next day, the local admin for FGTC issues the following command:

Question # 19

FGTC # config system csf

set configuration-sync default

end

In this scenario, which outcome is true regarding the "subnet_1" firewall address object on FGTC?

Options:

The object will only be automatically created on FGTC if it is modified on FGTA-1.

The object needs to be recreated on FGTA-1 before it is automatically created on FGTC.

The object is not automatically created.

The object is automatically created.

Answer

Questions # 20:

Refer to the exhibit, which shows a VPN topology.

Question # 20

The device IP 10.1.100.40 downloads a file from the FTP server IP 192.168.4.50

Referring to the exhibit, what will be the traffic flow behavior if ADVPN is configured in this environment?

Options:

All the session traffic will pass through the Hub

The TCP port 21 must be allowed on the NAT Device2

ADVPN is not supported when spokes are behind NAT

Spoke1 will establish an ADVPN shortcut to Spoke2

Answer

Explanation

D is correct because Spoke1 will establish an ADVPN shortcut to Spoke2 when it detects that there is a demand for traffic between them. This is explained in the Fortinet Community article on Technical Tip: Fortinet Auto Discovery VPN (ADVPN) under Summary - ADVPN sequence of events. References:https://community.fortinet.com/t5/FortiGate/Technical-Tip-Fortinet-Auto-Discovery-VPN-ADVPN/ta-p/195698

Viewing page 2 out of 4 pages

Viewing questions 11-20 out of questions