Fortinet NSE8_812 Exam Questions Instant Access

Question 1

Refer to the exhibit, which shows a multi-region SD-WAN architecture.

Given this scenario, which two statements are true? (Choose two.)

AIf iBGP is used, cross-regional spoke-to-hub shortcuts can be established.

BIf eBGP is used, ADVPN can be established for branch-to-branch traffic across regions.

CIf eBGP is used, ADVPN can be established only for branch-to-branch traffic within each region.

DIf iBGP is used, cross-regional spoke-to-hub shortcuts cannot be used.

Answer : C

Question 2

Refer to the exhibit.

You are managing a FortiSwitch 3032E that is managed by FortiLink on a FortiGate 3960E. The 3032E is heavily utilized and there is only one port free.

The requirement is to add an additional three FortiSwitch 448E devices with 10Gbps SFP+ connectivity directly to the 3032E. The plan is to use split port (phy-mode) with QSFP28 mode to connect the new 448E switches.

In this scenario, which statement about the switch deployment is correct?

AAdditional ports on Switch 1 can be split for a maximum of 128 interfaces.

BThe port most of Switch 1 must be changed to QSFP.

CAfter enabling split ports and rebooting Switch 1, the new ports can be configured from the FortiGate.

DSwitches 2-4 will connect successfully with Switch 1 split port in QSFP28 mode.

Answer : B

Question 3

A customer is operating a FortiWeb cluster in a high volume active-active HA group consisting of eight FortiWeb appliances. One of the secondary members is handling traffic for one specific VIP.

What will happen with the traffic if that secondary FortiWeb appliance fails?

ATraffic will be redirected to the next appliance in the same traffic group.

BTraffic will be redistributed by the primary appliance to the remaining secondary appliances.

CTraffic will be redistributed by the primary appliance to the remaining secondary appliances that are configured to handle traffic for that specific VIP.

DTraffic will be redirected to the secondary member with the least number of sessions.

Answer : A

Question 4

Refer to the exhibits.

Exhibit A

Exhibit B

Exhibit C

A customer is trying to set up a VPN with a FortiGate, but they do not have a backup of the configuration. Output during a troubleshooting session is shown in the exhibits A and B and a baseline VPN configuration is shown in Exhibit C Referring to the exhibits, which configuration will restore VPN connectivity?

AOption A

BOption B

COption C

DOption D

Answer : C

The output in Exhibit A shows that the VPN tunnel is not established because the peer IP address is incorrect. The output in Exhibit B shows that the peer IP address is 192.168.1.100, but the baseline VPN configuration in Exhibit C shows that the peer IP address should be 192.168.1.101.

To restore VPN connectivity, you need to change the peer IP address in the VPN tunnel configuration to 192.168.1.101. The correct configuration is shown below:

config vpn ipsec phase1-interface

edit 'wan'

set peer-ip 192.168.1.101

set peer-id 192.168.1.101

set dhgrp 1

set auth-mode psk

set psk SECRET_PSK

end

Option A is incorrect because it does not change the peer IP address. Option B is incorrect because it changes the peer IP address to 192.168.1.100, which is the incorrect IP address. Option D is incorrect because it does not include the necessary configuration for the VPN tunnel.

Question 5

Refer to the exhibits.

An administrator has configured a FortiGate and Forti Authenticator for two-factor authentication with FortiToken push notifications for their SSL VPN login. Upon initial review of the setup, the administrator has discovered that the customers can manually type in their two-factor code and authenticate but push notifications do not work

Based on the information given in the exhibits, what must be done to fix this?

AOn FG-1 port1, the ftm access protocol must be enabled.

BFAC-1 must have an internet routable IP address for push notifications.

COn FG-1 CLI, the ftm-push server setting must point to 100.64.141.

DOn FAC-1, the FortiToken public IP setting must point to 100.64.1 41

Answer : D

https://community.fortinet.com/t5/FortiAuthenticator/Technical-Tip-FortiToken-Push-on-FortiAuthenticator-operation/ta-p/190810

Question 6

Refer to the exhibit.

FortiManager is configured with the Jinja Script under CLI Templates shown in the exhibit.

Which two statements correctly describe the expected behavior when running this template? (Choose two.)

AThe Jinja template will automatically map the interface with 'WAN' role on the managed FortiGate.

BThe template will work if you change the variable format to $(WAN).

CThe template will work if you change the variable format to {{ WAN }}.

DThe administrator must first manually map the interface for each device with a meta field.

EThe template will fail because this configuration can only be applied with a CLI or TCL script.

Answer : D, E

D . The administrator must first manually map the interface for each device with a meta field.

The Jinja template in the exhibit is expecting a meta field called WAN to be set on the managed FortiGate. This meta field will specify which interface on the FortiGate should be assigned the 'WAN' role. If the meta field is not set, then the template will fail.

E . The template will fail because this configuration can only be applied with a CLI or TCL script.

The Jinja template in the exhibit is trying to configure the interface role on the managed FortiGate. This type of configuration can only be applied with a CLI or TCL script. The Jinja template will fail because it is not a valid CLI or TCL script.

Question 7

An administrator has configured a FortiGate device to authenticate SSL VPN users using digital certificates. A FortiAuthenticator is the certificate authority (CA) and the OCSP server.

Part of the FortiGate configuration is shown below:

Based on this configuration, which authentication scenario will FortiGate deny?

AThe user certificate does not contain the OCSP URL.

BFortiAuthenticator responds to an OCSP request that the user certificate authority is untrusted.

CFortiAuthenticator responds to an OCSP request that the user certificate status is unknown.

Answer : B

Fortinet NSE 8 - Written NSE8_812 Exam Questions