• ホーム
  • ブログ
  • 合格させるFortinet NSE8_812にはPassTest提供の試験問題集で2024年03月更新 [Q36-Q58]

合格させるFortinet NSE8_812にはPassTest提供の試験問題集で2024年03月更新 [Q36-Q58]

Share

合格させるFortinet NSE8_812にはPassTest提供の試験問題集で2024年03月更新

完全版最新のNSE8_812問題集、100%カバー率問題と解答があなたをリアル試験で合格させる


Fortinet NSE8_812試験では、高度な脅威保護、アプリケーションセキュリティ、クラウドセキュリティ、セキュアアクセス、ネットワークセキュリティオペレーションなど、ネットワークセキュリティに関連する幅広いトピックをカバーしています。また、Fortinetのセキュリティファブリックアーキテクチャもカバーしており、さまざまなセキュリティテクノロジーを統合して、高度な脅威に対する包括的な保護を提供します。

 

質問 # 36
Refer to the exhibit containing the configuration snippets from the FortiGate. Customer requirements:

* SSLVPN Portal must be accessible on standard HTTPS port (TCP/443)
* Public IP address (129.11.1.100) is assigned to portl
* Datacenter.acmecorp.com resolves to the public IP address assigned to portl The customer has a Let's Encrypt certificate that is going to expire soon and it reports that subsequent attempts to renew that certificate are failing.
Reviewing the requirement and the exhibit, which configuration change below will resolve this issue?
A)

B)

C)

  • A. Option D
  • B. Option C
  • C. Option A
  • D. Option B

正解：B

解説：
To resolve the issue of failing to renew the Let's Encrypt certificate, the configuration change that is needed is to enable the HTTP-to-HTTPS redirect option in the SSL-VPN settings. This option allows the FortiGate to redirect HTTP requests to HTTPS port 443, which is required for Let's Encrypt to validate the domain ownership and issue a new certificate. By enabling this option, the FortiGate will be able to respond to the HTTP challenge from Let's Encrypt and renew the certificate successfully. Reference: https://docs.fortinet.com/document/fortigate/6.4.0/cookbook/103437/inbound-ssl-inspection https://docs.fortinet.com/document/fortigate/6.4.0/cookbook/103438/application-detection-on-ssl-offloaded-traffic


質問 # 37
You are responsible for recommending an adapter type for NICs on a FortiGate VM that will run on an ESXi Hypervisor. Your recommendation must consider performance as the main concern, cost is not a factor. Which adapter type for the NICs will you recommend?

  • A. Native ESXi Networking with E1000
  • B. Physical Function (PF) PCI Passthrough
  • C. Virtual Function (VF) PCI Passthrough
  • D. Native ESXi Networking with VMXNET3

正解：D

解説：
The FortiGate VM is a virtual firewall appliance that can run on various hypervisors, such as ESXi, Hyper-V, KVM, etc. The adapter type for NICs on a FortiGate VM determines the performance and compatibility of the network interface cards with the hypervisor and the physical network. There are different adapter types available for NICs on a FortiGate VM, such as E1000, VMXNET3, SR-IOV, etc. If performance is the main concern and cost is not a factor, one option is to use native ESXi networking with VMXNET3 adapter type for NICs on a FortiGate VM that will run on an ESXi hypervisor. VMXNET3 is a paravirtualized network interface card that is optimized for performance in virtual machines and supports features such as multiqueue support, Receive Side Scaling (RSS), Large Receive Offload (LRO), IPv6 offloads, and MSI/MSI-X interrupt delivery. Native ESXi networking means that the FortiGate VM uses the standard virtual switch (vSwitch) or distributed virtual switch (dvSwitch) provided by the ESXi hypervisor to connect to the physical network. This option can provide high performance and compatibility for NICs on a FortiGate VM without requiring additional hardware or software components. Reference: https://docs.fortinet.com/document/fortigate/7.0.0/vm-installation-for-vmware-esxi/19662/installing-fortigate-vm-on-vmware-esxi https://docs.fortinet.com/document/fortigate/7.0.0/vm-installation-for-vmware-esxi/19662/networking


質問 # 38
A customer with a FortiDDoS 200F protecting their fibre optic internet connection from incoming traffic sees that all the traffic was dropped by the device even though they were not under a DoS attack. The traffic flow was restored after it was rebooted using the GUI. Which two options will prevent this situation in the future? (Choose two)

  • A. Move the internet connection from the SFP interfaces to the LC interfaces
  • B. Create an HA setup with a second FortiDDoS 200F
  • C. Replace with a FortiDDoS 1500F
  • D. Change the Adaptive Mode.

正解：B、C

解説：
B is correct because creating an HA setup with a second FortiDDoS 200F will provide redundancy in case one of the devices fails. This will prevent all traffic from being dropped in the event of a failure.
D is correct because the FortiDDoS 1500F has a larger throughput capacity than the FortiDDoS 200F. This means that it will be less likely to drop traffic even under heavy load.
The other options are incorrect. Option A is incorrect because changing the Adaptive Mode will not prevent the device from dropping traffic. Option C is incorrect because moving the internet connection from the SFP interfaces to the LC interfaces will not change the throughput capacity of the device.
References:
FortiDDoS 200F Datasheet | Fortinet Document Library
FortiDDoS 1500F Datasheet | Fortinet Document Library
High Availability (HA) on FortiDDoS | FortiDDoS / FortiOS 7.0.0 - Fortinet Document Library


質問 # 39
You must analyze an event that happened at 20:37 UTC. One log relevant to the event is extracted from FortiGate logs:

The devices and the administrator are all located in different time zones Daylight savings time (DST) is disabled
* The FortiGate is at GMT-1000.
* The FortiAnalyzer is at GMT-0800
* Your browser local time zone is at GMT-03.00
You want to review this log on FortiAnalyzer GUI, what time should you use as a filter?

  • A. 20:37:08
  • B. 10:37:08
  • C. 17:37:08
  • D. 12.37:08

正解：C

解説：
To review this log on FortiAnalyzer GUI, the administrator should use the time filter that matches the local time zone of FortiAnalyzer, which is GMT-0800. Since the log was generated at 20:37 UTC (GMT+0000), the corresponding time in GMT-0800 is 20:37 - 8 hours = 12:37. However, since DST is disabled on FortiAnalyzer, the administrator should add one hour to account for daylight saving time difference, resulting in 12:37 + 1 hour = 13:37. Therefore, the time filter to use is 13:37:08. References: https://docs.fortinet.com/document/fortianalyzer/6.4.0/administration-guide/103664/time-zone-and-daylight-saving-time


質問 # 40
Refer to the exhibit showing a firewall policy configuration.

To prevent unauthorized access of their cloud assets, an administrator wants to enforce authentication on firewall policy ID 1.
What change does the administrator need to make?

  • A.
  • B.
  • C.
  • D.

正解：D

解説：
The firewall policy in the exhibit allows all traffic from the internal network to the cloud. To enforce authentication on this traffic, the administrator needs to add the auth-on-demand option to the policy. This option will force all users to authenticate before they are allowed to access the cloud.
The following is the correct configuration:
config firewall policy
edit 1
set srcintf "internal"
set dstintf "wan1"
set srcaddr "all"
set dstaddr "all"
set service "all"
set action accept
set auth-on-demand enable
References:
Configuring firewall authentication | FortiGate / FortiOS 7.4.0 - Fortinet Document Library Firewall policy configuration | FortiGate / FortiOS 7.4.0 - Fortinet Document Library


質問 # 41
Refer to the exhibit, which shows the high availability configuration for the FortiAuthenticator (FAC1).

Based on this information, which statement is true about the next FortiAuthenticator (FAC2) member that will join an HA cluster with this FortiAuthenticator (FAC1)?

  • A. FSSO sessions from FAC1 will be synchronized to FAC2.
  • B. FAC2 can only process requests when FAC1 fails.
  • C. FAC2 can have its HA interface on a different network than FAC1.
  • D. The FortiToken license will need to be installed on the FAC2.

正解：A

解説：
When FortiAuthenticator operates in cluster mode, it provides active-passive failover and synchronization of all configuration and data, including FSSO sessions, between the cluster members. Therefore, if FAC1 is the active unit and FAC2 is the standby unit, any FSSO sessions from FAC1 will be synchronized to FAC2. If FAC1 fails, FAC2 will take over the active role and continue to process the FSSO sessions. References: https://docs.fortinet.com/document/fortiauthenticator/6.1.2/administration-guide/122076/high-availability


質問 # 42
Refer to the exhibits.

A customer has deployed a FortiGate with iBGP and eBGP routing enabled. HQ is receiving routes over eBGP from ISP 2; however, only certain routes are showing up in the routing table-Assume that BGP is working perfectly and that the only possible modifications to the routing table are solely due to the prefix list that is applied on HQ.
Given the exhibits, which two routes will be active in the routing table on the HQ firewall? (Choose two.)

  • A. 172.16.204.64/27
  • B. 172.16.201.96/29
  • C. 172.16.204.128/25
  • D. 172,620,64,27

正解：C、D

解説：
A is correct because 172.16.204.128/25 matches the prefix list entry 172.16.204.0/24 ge 25 le 25. C is correct because 172.16.204.64/27 matches the prefix list entry 172.16.204.0/24 ge 27 le 27. Reference: https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/978793/bgp


質問 # 43
Refer to the exhibit.

A customer has deployed a FortiGate 300E with virtual domains (VDOMs) enabled in the multi-VDOM mode. There are three VDOMs: Root is for management and internet access, while VDOM 1 and VDOM 2 are used for segregating internal traffic. AccountVInk and SalesVInk are standard VDOM links in Ethernet mode.
Given the exhibit, which two statements below about VDOM behavior are correct? (Choose two.)

  • A. You can apply OSPF routing on the VDOM link in either PPP or Ethernet mode
  • B. Root VDOM is an Admin type VDOM, while VDOM 1 and VDOM 2 are Traffic type VDOMs.
  • C. OSPF routing can be configured between VDOM 1 and Root VDOM without any configuration changes to AccountVInk
  • D. Traffic on AccountVInk and SalesVInk will not be accelerated.
  • E. The VDOM links are in Ethernet mode because they have IP addressed assigned on both sides.

正解：A、B

解説：
a) You can apply OSPF routing on the VDOM link in either PPP or Ethernet mode. This is because VDOM links can be configured in either PPP or Ethernet mode, and OSPF routing can be configured on both types of links.
d) Root VDOM is an Admin type VDOM, while VDOM 1 and VDOM 2 are Traffic type VDOMs. This is because the Root VDOM is the default VDOM, and it is used for management and internet access. VDOM 1 and VDOM 2 are traffic type VDOMs, which are used for segregating internal traffic.
The other options are not correct.
b) Traffic on AccountVInk and SalesVInk will not be accelerated. This is because VDOM links are not accelerated by default. However, you can configure acceleration on VDOM links if you want.
c) The VDOM links are in Ethernet mode because they have IP addressed assigned on both sides. This is not necessarily true. The VDOM links could be in PPP mode even if they have IP addresses assigned on both sides.
e) OSPF routing can be configured between VDOM 1 and Root VDOM without any configuration changes to AccountVInk. This is correct. OSPF routing can be configured between any two VDOMs, even if they are not directly connected. In this case, the OSPF routing would be configured on the AccountVInk link.


質問 # 44
Which two statements are correct on a FortiGate using the FortiGuard Outbreak Protection Service (VOS)? (Choose two.)

  • A. If third-party AV database returns a match the scanned file is deemed to be malicious.
  • B. The AV engine scan must be enabled to use the FortiGuard VOS feature
  • C. The antivirus database queries FortiGuard with the hash of a scanned file
  • D. The hash signatures are obtained from the FortiGuard Global Threat Intelligence database.
  • E. The FortiGuard VOS can be used only with proxy-base policy inspections.

正解：C、D

解説：
c) The antivirus database queries FortiGuard with the hash of a scanned file. This is how the FortiGuard VOS service works. The FortiGate queries FortiGuard with the hash of a scanned file, and FortiGuard returns a list of known malware signatures that match the hash.
e) The hash signatures are obtained from the FortiGuard Global Threat Intelligence database. This is where the FortiGuard VOS service gets its hash signatures from. The FortiGuard Global Threat Intelligence database is updated regularly with new malware signatures.


質問 # 45
You are running a diagnose command continuously as traffic flows through a platform with NP6 and you obtain the following output:

Given the information shown in the output, which two statements are true? (Choose two.)

  • A. Host-shortcut mode is enabled.
  • B. There are packet drops at the XAUI.
  • C. The output is showing a packet descriptor queue accumulated counter
  • D. Enabling bandwidth control between the ISF and the NP will change the output
  • E. Enable HPE shaper for the NP6 will change the output

正解：B、C

解説：
The diagnose command shown in the output is used to display information about NP6 packet descriptor queues. The output shows that there are 16 NP6 units in total, and each unit has four XAUI ports (XA0-XA3). The output also shows that there are some non-zero values in the columns PDQ ACCU (packet descriptor queue accumulated counter) and PDQ DROP (packet descriptor queue drop counter). These values indicate that there are some packet descriptor queues that have reached their maximum capacity and have dropped some packets at the XAUI ports. This could be caused by congestion or misconfiguration of the XAUI ports or the ISF (Internal Switch Fabric). References: https://docs.fortinet.com/document/fortigate/7.0.0/cli-reference/19662/diagnose-np6-pdq The output is showing a packet descriptor queue accumulated counter, which is a measure of the number of packets that have been dropped by the NP6 due to congestion. The counter will increase if there are more packets than the NP6 can handle, which can happen if the bandwidth between the ISF and the NP is not sufficient or if the HPE shaper is enabled.
The output also shows that there are packet drops at the XAUI, which is the interface between the NP6 and the FortiGate's backplane. This means that the NP6 is not able to keep up with the traffic and is dropping packets.
The other statements are not true. Host-shortcut mode is not enabled, and enabling bandwidth control between the ISF and the NP will not change the output. HPE shaper is a feature that can be enabled to improve performance, but it will not change the output of the diagnose command.


質問 # 46
Refer to the exhibit.

FortiManager is configured with the Jinja Script under CLI Templates shown in the exhibit.
Which two statements correctly describe the expected behavior when running this template? (Choose two.)

  • A. The Jinja template will automatically map the interface with "WAN" role on the managed FortiGate.
  • B. The template will fail because this configuration can only be applied with a CLI or TCL script.
  • C. The template will work if you change the variable format to $(WAN).
  • D. The administrator must first manually map the interface for each device with a meta field.
  • E. The template will fail because this configuration can only be applied with a CLI or TCL script.
  • F. The template will work if you change the variable format to {{ WAN }}.

正解：B、D

解説：
The Jinja template in the exhibit is trying to configure the interface role on the managed FortiGate. This type of configuration can only be applied with a CLI or TCL script. The Jinja template will fail because it is not a valid CLI or TCL script.
Explanation:
d) The administrator must first manually map the interface for each device with a meta field.
The Jinja template in the exhibit is expecting a meta field called WAN to be set on the managed FortiGate. This meta field will specify which interface on the FortiGate should be assigned the "WAN" role. If the meta field is not set, then the template will fail.


質問 # 47
Refer to the exhibit.

The exhibit shows the forensics analysis of an event detected by the FortiEDR core In this scenario, which statement is correct regarding the threat?

  • A. This is an exfiltration attack and has been stopped by FortiEDR.
  • B. This is a ransomware attack and has been stopped by FortiEDR
  • C. This is an exfiltration attack and has not been stopped by FortiEDR
  • D. This is a ransomware attack and has not been stopped by FortiEDR.

正解：B

解説：
The exhibit shows the forensics analysis of an event detected by the FortiEDR core. The event graph indicates that a process named svchost.exe was launched by a malicious file named 1.exe, which was downloaded from a suspicious URL. The process then attempted to encrypt files in various folders, such as Documents, Pictures, and Desktop, which are typical targets of ransomware attacks. However, FortiEDR was able to stop the process and prevent any file encryption by applying its real-time post-execution prevention feature. Therefore, this is a ransomware attack and has been stopped by FortiEDR. Reference: https://docs.fortinet.com/document/fortiedr/6.0.0/administration-guide/733983/forensics https://www.fortinet.com/content/dam/fortinet/assets/data-sheets/fortiedr.pdf


質問 # 48
You want to use the MTA adapter feature on FortiSandbox in an HA-Cluster. Which statement about this solution is true?

  • A. The MTA adapter is only available in the primary node.
  • B. The configuration is different than on a standalone device.
  • C. The MTA adapter mode is only detection mode.
  • D. The configuration of the MTA Adapter Local Interface is different than on port1.

正解：A

解説：
The MTA adapter feature on FortiSandbox is a feature that allows FortiSandbox to act as a mail transfer agent (MTA) that can receive, inspect, and forward email messages from external sources. The MTA adapter feature can be used to integrate FortiSandbox with third-party email security solutions that do not support direct integration with FortiSandbox, such as Microsoft Exchange Server or Cisco Email Security Appliance (ESA). The MTA adapter feature can also be used to enhance email security by adding an additional layer of inspection and filtering before delivering email messages to the final destination. The MTA adapter feature can be enabled on FortiSandbox in an HA-Cluster, which is a configuration that allows two FortiSandbox units to synchronize their settings and data and provide high availability and load balancing for sandboxing services. However, one statement about this solution that is true is that the MTA adapter is only available in the primary node. This means that only one FortiSandbox unit in the HA-Cluster can act as an MTA and receive email messages from external sources, while the other unit acts as a backup node that can take over the MTA role if the primary node fails or loses connectivity. This also means that only one IP address or FQDN can be used to configure the external sources to send email messages to the FortiSandbox MTA, which is the IP address or FQDN of the primary node. Reference: https://docs.fortinet.com/document/fortisandbox/3.2.0/administration-guide/19662/mail-transfer-agent-mta https://docs.fortinet.com/document/fortisandbox/3.2.0/administration-guide/19662/high-availability-ha


質問 # 49
A customer is planning on moving their secondary data center to a cloud-based laaS. They want to place all the Oracle-based systems Oracle Cloud, while the other systems will be on Microsoft Azure with ExpressRoute service to their main data center.
They have about 200 branches with two internet services as their only WAN connections. As a security consultant you are asked to design an architecture using Fortinet products with security, redundancy and performance as a priority.
Which two design options are true based on these requirements? (Choose two.)

  • A. Branch FortiGate devices must be configured as VPN clients for the branches' internal network to be able to access Oracle services without using public IPs.
  • B. Use FortiGate VM for IPSEC over ExpressRoute, as traffic is not encrypted by Azure.
  • C. Systems running on Azure will need to go through the main data center to access the services on Oracle Cloud.
  • D. Two ExpressRoute services to the main data center are required to implement SD-WAN between a FortiGate VM in Azure and a FortiGate device at the data center edge

正解：B、D

解説：
To secure the traffic between Azure and the main data center, a FortiGate VM can be deployed in Azure and configured to use IPSEC over ExpressRoute, as traffic is not encrypted by Azure by default. This also allows the use of Fortinet security features such as antivirus, IPS, web filtering, and application control. To implement SD-WAN between Azure and the main data center, two ExpressRoute services are required to provide redundant paths and load balancing. A FortiGate device at the data center edge can be configured to use SD-WAN rules to select the best path based on performance, availability, and cost. Reference: https://docs.fortinet.com/document/fortigate/6.4.0/cookbook/103440/ipsec-vpn-between-fortigate-and-azure https://docs.fortinet.com/document/fortigate/6.4.0/cookbook/103441/sd-wan-between-fortigate-and-azure


質問 # 50
Refer to the exhibits.
Exhibit A

Exhibit B

Exhibit C

A customer is trying to set up a VPN with a FortiGate, but they do not have a backup of the configuration. Output during a troubleshooting session is shown in the exhibits A and B and a baseline VPN configuration is shown in Exhibit C Referring to the exhibits, which configuration will restore VPN connectivity?

  • A.
  • B.
  • C.
  • D.

正解：A

解説：
The VPN configuration shown in Exhibit C is a baseline VPN configuration that uses IKEv2 with pre-shared keys and AES256 encryption for both IKE and ESP phases. However, this configuration does not match the output shown in Exhibit A and B, which indicate that IKEv1 is used with RSA signatures and AES128 encryption for both IKE and ESP phases. Therefore, to restore VPN connectivity, the configuration needs to be modified to match these parameters. Option B shows the correct configuration that matches these parameters. Option A is incorrect because it still uses IKEv2 instead of IKEv1. Option C is incorrect because it still uses pre-shared keys instead of RSA signatures. Option D is incorrect because it still uses AES256 encryption instead of AES128 encryption. Reference: https://docs.fortinet.com/document/fortigate/7.0.0/cookbook/19662/ipsec-vpn-with-forticlient


質問 # 51
An automation stitch was configured using an incoming webhook as the trigger named 'my_incoming_webhook'. The action is configured to execute the CLI Script shown:

  • A.
  • B.
  • C.
  • D.

正解：A

解説：
The CLI script in option A will send the log message to the webhook server. The webhook server can then be configured to take any desired action, such as storing the log message in a database or sending an email notification.
The other options are incorrect. Option B will not send the log message to the webhook server because it does not contain the curl command. Option C will send the log message to the webhook server, but it will also include the FortiGate's IP address and MAC address. This information is not necessary, and it could be used by an attacker to identify the FortiGate. Option D will not send the log message to the webhook server because it does not contain the webhook action.
References:
Automation webhook stitches: https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/989735/webhook-action Webhooks: https://en.wikipedia.org/wiki/Webhook


質問 # 52
Which two statements are correct on a FortiGate using the FortiGuard Outbreak Protection Service (VOS)? (Choose two.)

  • A. If third-party AV database returns a match the scanned file is deemed to be malicious.
  • B. The AV engine scan must be enabled to use the FortiGuard VOS feature
  • C. The antivirus database queries FortiGuard with the hash of a scanned file
  • D. The hash signatures are obtained from the FortiGuard Global Threat Intelligence database.
  • E. The FortiGuard VOS can be used only with proxy-base policy inspections.

正解：C、D

解説：
The FortiGuard Outbreak Prevention Service (VOS) is a feature that enhances the antivirus scanning capabilities of FortiGate by querying FortiGuard with the hash of a scanned file that is not found in the local antivirus database. If the hash matches a signature in the FortiGuard Global Threat Intelligence database, which contains information about known malware and zero-day threats, the file is deemed to be malicious and blocked by FortiGate. The VOS feature can be used with both proxy-based and flow-based policy inspections, and does not require the AV engine scan to be enabled. Reference: https://docs.fortinet.com/document/fortigate/6.2.14/cookbook/968606/outbreak-prevention-service


質問 # 53
Review the VPN configuration shown in the exhibit.

What is the Forward Error Correction behavior if the SD-WAN network traffic download is 500 Mbps and has 8% of packet loss in the environment?

  • A. 1 redundant packet for every 10 base packets
  • B. 3 redundant packet for every 9 base packets
  • C. 2 redundant packet for every 8 base packets
  • D. 3 redundant packet for every 5 base packets

正解：D

解説：
Forward Error Correction (FEC) is a feature that can improve the quality of SD-WAN network traffic by adding redundant packets to the original packets. The ratio of redundant packets to base packets is determined by the FEC mode, which can be set to low, medium, or high. In low mode, the ratio is 1:10, in medium mode, the ratio is 2:8, and in high mode, the ratio is 3:5. The FEC mode can be configured manually or automatically based on the bandwidth and packet loss of the network. In this case, since the download bandwidth is 500 Mbps and the packet loss is 8%, the FEC mode is automatically set to high, which means that 3 redundant packets are added for every 5 base packets. Reference: https://docs.fortinet.com/document/fortigate/7.0.0/sd-wan/19662/forward-error-correction-fec


質問 # 54
Review the following FortiGate-6000 configuration excerpt:

Based on the configuration, which statement is correct regarding SNAT source port partitioning behavior?

  • A. It statically distributes SNAT source ports to operating FPCs or FPMs
  • B. It equally distributes SNAT source ports across chassis slots.
  • C. It dynamically distributes SNAT source ports to operating FPCs or FPMs.
  • D. It is the default SNAT configuration and preserves active sessions when an FPC or FPM goes down.

正解：C

解説：
The configuration excerpt shows that the SNAT source port partitioning behavior is set to dynamic. This means that the FortiGate will dynamically distribute SNAT source ports to operating FPCs or FPMs. This ensures that active sessions are not interrupted if an FPC or FPM goes down.
The other options are incorrect. Option B is incorrect because the default SNAT configuration is static. Option C is incorrect because the configuration excerpt does not specify that SNAT source ports are statically distributed. Option D is incorrect because the SNAT source ports are not evenly distributed across chassis slots.
Here are some additional details about SNAT source port partitioning behavior:
SNAT source port partitioning behavior can be set to dynamic or static.
The default SNAT configuration is static.
Dynamic SNAT source port partitioning ensures that active sessions are not interrupted if an FPC or FPM goes down.
Static SNAT source port partitioning can improve performance by reducing the number of SNAT lookups.


質問 # 55
Refer to the exhibits.

A FortiGate cluster (CL-1) protects a data center hosting multiple web applications. A pair of FortiADC devices are already configured for SSL decryption (FAD-1), and re-encryption (FAD-2). CL-1 must accept unencrypted traffic from FAD-1, perform application detection on the plain-text traffic, and forward the inspected traffic to FAD-2.
The SSL-Offload-App-Detect application list and SSL-Offload protocol options profile are applied to the firewall policy handling the web application traffic on CL-1.
Given this scenario, which two configuration tasks must the administrator perform on CL-1? (Choose two.) A)

B)


  • A. Option D
  • B. Option B
  • C. Option C
  • D. Option A

正解：B、C

解説：
To enable application detection on plain-text traffic that has been decrypted by FortiADC, the administrator must perform two configuration tasks on CL-1:
Enable SSL offloading in the firewall policy and select the SSL-Offload protocol options profile.
Enable application control in the firewall policy and select the SSL-Offload-App-Detect application list. Reference: https://docs.fortinet.com/document/fortigate/6.4.0/cookbook/103438/application-detection-on-ssl-offloaded-traffic


質問 # 56
Refer to the exhibit showing an SD-WAN configuration.

According to the exhibit, if an internal user pings 10.1.100.2 and 10.1.100.22 from subnet 172.16.205.0/24, which outgoing interfaces will be used?

  • A. port16 and port1
  • B. port16 and port15
  • C. port1 and port1
  • D. port1 and port15

正解：A

解説：
According to the exhibit, the SD-WAN configuration has two rules: one for traffic to 10.1.100.0/24 subnet, and one for traffic to 10.1.100.16/28 subnet. The first rule uses the best quality strategy, which selects the SD-WAN member with the best measured quality based on performance SLA metrics. The second rule uses the manual strategy, which specifies port1 as the SD-WAN member to select. Therefore, if an internal user pings 10.1.100.2 and 10.1.100.22 from subnet 172.16.205.0/24, the outgoing interfaces will be port16 and port1 respectively, assuming that port16 has the best quality among the SD-WAN members. References: https://docs.fortinet.com/document/fortigate/6.2.14/cookbook/218559/configuring-the-sd-wan-interface


質問 # 57
Refer to the exhibits.
The exhibits show a diagram of a requested topology and the base IPsec configuration.
A customer asks you to configure ADVPN via two internet underlays. The requirement is that you use one interface with a single IP address on DC FortiGate.
In this scenario, which feature should be implemented to achieve this requirement?

  • A. Use local-id
  • B. Use network-overlay id
  • C. Change advpn2 to IKEv1
  • D. Use peer-id

正解：B

解説：
A is correct because using network-overlay id allows you to configure multiple ADVPN tunnels on a single interface with a single IP address on the DC FortiGate. This is explained in the FortiGate Administration Guide under ADVPN > Configuring ADVPN > Configuring ADVPN on the hub. Reference: https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/978793/advpn https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/978793/advpn/978794/configuring-advpn


質問 # 58
......

最新NSE8_812試験問題集有効で最新の問題集：https://www.passtest.jp/Fortinet/NSE8_812-shiken.html

検証済みNSE8_812試験解答合格確定させる：https://drive.google.com/open?id=1TbN2OOwxiu-mqXsLDRpHY6kA2BipdO_E

関するブログ

もっと
NSE8_812 無料問題集