Exit demo NSE8_812 Network Security Expert 8 Written Exam PDF format · free preview

Fortinet NSE8_812 - Questions & Answers

Free preview · every answer includes a full explanation

Product page: https://prepkeys.com/nse8-812.html

Question 1
Multiple choice

Refer to the exhibits.

The exhibits show a FortiMail network topology, Inbound configuration settings, and a Dictionary Profile.

You are required to integrate a third-party's host service (srv.thirdparty.com) into the e-mail processing path.

All inbound e-mails must be processed by FortiMail antispam and antivirus with FortiSandbox integration. If the email is clean, FortiMail must forward it to the third-party service, which will send the email back to FortiMail for final delivery, FortiMail must not scan the e-mail again.

Which three configuration tasks must be performed to meet these requirements? (Choose three.)

A.

Change the scan order in FML-GW to antispam-sandbox-content.

B.

Apply the Catch-Ail profile to the CFInbound profile and configure a content action profile to deliver to the srv. thirdparty. com FQDN

C.

Create an access receive rule with a Sender value of srv. thirdparcy.com, Recipient value of *@acme.com, and action value of Safe

D.

Apply the Catch-AII profile to the ASinbound profile and configure an access delivery rule to deliver to the 100.64.0.72 host.

E.

Create an IP policy with a Source value of 100. 64 .0.72/32, enable precedence, and place the policy at the top of the list.

Question 2
Multiple choice

A customer with a FortiDDoS 200F protecting their fibre optic internet connection from incoming traffic sees that all the traffic was dropped by the device even though they were not under a DoS attack. The traffic flow was restored after it was rebooted using the GUI.

Which two options will prevent this situation in the future? (Choose two)

A.

Change the Adaptive Mode.

B.

Create an HA setup with a second FortiDDoS 200F

C.

Move the internet connection from the SFP interfaces to the LC interfaces

D.

Replace with a FortiDDoS 1500F

Question 3
Single choice

You are migrating the branches of a customer to FortiGate devices. They require independent routing tables on the LAN side of the network.

After reviewing the design, you notice the firewall will have many BGP sessions as you have two data centers (DC) and two ISPs per DC while each branch is using at least 10 internal segments.

Based on this scenario, what would you suggest as the more efficient solution, considering that in the future the number of internal segments, DCs or internet links per DC will increase?

A.

No change in design is needed as even small FortiGate devices have a large memory capacity.

B.

Acquire a FortiGate model with more capacity, considering the next 5 years growth.

C.

Implement network-id, neighbor-group and increase the advertisement-interval

D.

Redesign the SD-WAN deployment to only use a single VPN tunnel and segment traffic using VRFs on
BGP

Question 4
Multiple choice

You have configured a Site-to-Site IPsec VPN tunnel between a FortiGate and a third-party device but notice that one of the error counters on the tunnel interface keeps increasing.

Which two configuration options can resolve this problem? (Choose two.)

A.

Enable Forward Error Correction (FEC) on the VPN interface for egress traffic.

B.

Adjust the MTU of the physical interface to which the IPsec tunnel is bound.

C.

Enable DF-bit honoring in the global settings.

D.

Adjust the MTU of the IPsec interface.

Question 5
Single choice

Refer to the exhibit.

You are operating an internal network with multiple OSPF routers on the same LAN segment. FGT_3 needs to be added to the OSPF network and has the configuration shown in the exhibit. FGT_3 is not establishing any OSPF connection.

What needs to be changed to the configuration to make sure FGT_3 will establish OSPF neighbors without affecting the DR/BDR election?

A.

Option A

B.

Option B

C.

Option C

D.

Option D

Question 6
Single choice

An HA topology is using the following configuration:

Based on this configuration, how long will it take for a failover to be detected by the secondary cluster member?

A.

600ms

B.

200ms

C.

300ms

D.

100ms

Question 7
Single choice

Refer to the exhibit showing a FortiSOAR playbook.

You are investigating a suspicious e-mail alert on FortiSOAR, and after reviewing the executed playbook,

you can see that it requires intervention.

What should be your next step?

A.

Go to the Incident Response tasks dashboard and run the pending actions

B.

Click on the notification icon on FortiSOAR GUI and run the pending input action

C.

Run the Mark Drive by Download playbook action

D.

Reply to the e-mail with the requested Playbook action

Question 8
Single choice

Refer to the exhibit, which shows a multi-region SD-WAN architecture.

Given this scenario, which two statements are true? (Choose two.)

A.

If iBGP is used, cross-regional spoke-to-hub shortcuts can be established.

B.

If eBGP is used, ADVPN can be established for branch-to-branch traffic across regions.

C.

If eBGP is used, ADVPN can be established only for branch-to-branch traffic within each region.

D.

If iBGP is used, cross-regional spoke-to-hub shortcuts cannot be used.

Question 9
Single choice

Refer to the exhibit.

A customer reports that they are not able to reach subnet 10.10.10.0/24 from their FortiGate device.

Based on the exhibit, what should you do to correct the situation?

A.

Enable iBGP multipath

B.

Enable recursive resolution for BGP routes

C.

Enable next-hop-self feature

D.

Enable additional-path feature

Question 10
Single choice

A FortiGate must be configured to accept VoIP traffic which will include session initiation protocol (SIP) traffic.

Which statement about the VoIP configuration options is correct?

A.

Restricting SIP requests is only possible when using the SIP Session Helper.

B.

Rate tracking of SIP requests is only possible when the application layer gateway (ALG) is set to Flow mode.

C.

FortiOS cannot accept SIP traffic if both the SIP Session Helper and the application layer gateway (ALG) are disabled.

D.

By default, VoIP traffic will be processed using the SIP Session Helper.

Showing 10 of 105 questions · Unlock the full set