Fortinet NSE8_812 Exam Questions Instant Access

Question 1

An administrator has configured a FortiGate device to authenticate SSL VPN users using digital certificates. A FortiAuthenticator is the certificate authority (CA) and the OCSP server.

Part of the FortiGate configuration is shown below:

Based on this configuration, which authentication scenario will FortiGate deny?

AThe user certificate does not contain the OCSP URL.

BFortiAuthenticator responds to an OCSP request that the user certificate authority is untrusted.

CFortiAuthenticator responds to an OCSP request that the user certificate status is unknown.

Answer : B

Question 2

Refer to the exhibit showing a firewall policy configuration.

To prevent unauthorized access of their cloud assets, an administrator wants to enforce authentication on firewall policy ID 1.

What change does the administrator need to make?

AOption A

BOption B

COption C

DOption D

Answer : A

https://docs.fortinet.com/document/fortigate/6.2.0/new-features/238665/authentication-policy-extensions

Question 3

Refer to the exhibit.

A customer is trying to setup a Playbook automation using a FortiAnalyzer, FortiWeb and FortiGate. The intention is to have the FortiGate quarantine any source of SQL Injection detected by the FortiWeb. They got the automation stitch to trigger on the FortiGate when simulating an attack to their website, but the quarantine object was created with the IP 0.0.0.0. Referring to the configuration and logs in the exhibits, which two statements are true? (Choose two.)

AThe Group By option in the handler should be different to src, so src can be used on the Playbook configuration.

BFortiSOC Playbooks combining FortiWeb and FortiGate are not supported.

CTo diagnose this issue, you need to use the command diagnose test application oftpd 22.

DThe FortiAnalyzer ADOM Type must be Fabric.

ETo fix the issue the parameter for script on the Playbook configuration should be epip.

Answer : A, D

Question 4

Refer to the exhibit.

FortiManager is configured with the Jinja Script under CLI Templates shown in the exhibit.

Which two statements correctly describe the expected behavior when running this template? (Choose two.)

AThe Jinja template will automatically map the interface with 'WAN' role on the managed FortiGate.

BThe template will work if you change the variable format to $(WAN).

CThe template will work if you change the variable format to {{ WAN }}.

DThe administrator must first manually map the interface for each device with a meta field.

EThe template will fail because this configuration can only be applied with a CLI or TCL script.

Answer : D, E

D . The administrator must first manually map the interface for each device with a meta field.

The Jinja template in the exhibit is expecting a meta field called WAN to be set on the managed FortiGate. This meta field will specify which interface on the FortiGate should be assigned the 'WAN' role. If the meta field is not set, then the template will fail.

E . The template will fail because this configuration can only be applied with a CLI or TCL script.

The Jinja template in the exhibit is trying to configure the interface role on the managed FortiGate. This type of configuration can only be applied with a CLI or TCL script. The Jinja template will fail because it is not a valid CLI or TCL script.

Question 5

A customer has FortiAP devices in three branch offices managed from a FortiGate in the HQ. Each FortiAP is connected to a dedicated management VLAN.

The customer wants the users connected to the FortiAP SSIDs to use the branch local internet connection, but each branch uses a different VLAN ID for the bridge. HQ users travel to different branches and connect to the same SSID.

Which configuration option will solve this requirement?

ASet each FortiAP to a wtp-group and use set vlan-pooling wtp-group on the VAP configuration with the corresponding VLAN ID configuration for each group.

BSet a FortiAuthenticator for 802.1x authentication with the Tunnel-Type attribute set to VLAN and use set dynamic-vlan enable on the VAP configuration.

CUse set vlan-pooling round-robin on the VAP configuration with the corresponding vlan-pool.

DUse set vlan-pooling hash on the VAP configuration with the corresponding vlan-pool.

Answer : B

Question 6

Refer to the exhibits.

You are configuring a Let's Encrypt certificate to enable SSL protection to your website. When FortiWeb tries to retrieve the certificate, you receive a certificate status failed, as shown below.

Based on the Server Policy settings shown in the exhibit, which two configuration changes will resolve this issue? (Choose two.)

ADisable Redirect HTTP to HTTPS in the Server Policy.

BRemove the Web Protection Profile from this Server Policy.

CEnable HTTP service in the Server Policy.

DConfigure a TXT record of the domain and point to the IP address of the Virtual Server.

Answer : A, B

Question 7

Refer to the exhibit that shows VPN debugging output.

The VPN tunnel between headquarters and the branch office is not being established.

What is causing the problem?

AThe Phase-1 encryption algorithms are not matching.

BThere is no matching Diffie-Hellman Group.

CHQ is using IKE v1 and the branch office is using with IKE v2.

DThere is a mismatch in the ISAKMP SA lifetime.

Answer : A

Fortinet NSE 8 - Written NSE8_812 Exam Questions