Fortinet NSE8_812 Dumps Updated Dec 31, 2023 WIith 62 Questions [Q10-Q29]

QUESTION 10
You must configure an environment with dual-homed servers connected to a pair of FortiSwitch units using an MCLAG.
Multicast traffic is expected in this environment, and you should ensure unnecessary traffic is pruned from links that do not have a multicast listener.
In which two ways must you configure the igmps-f lood-traffic and igmps-flood-report settings? (Choose two.)

enable on the ISL and FortiLink trunks

enable on ICL trunks

disable on ICL trunks

disable on the ISL and FortiLink trunks

QUESTION 11
Refer to the exhibit showing an SD-WAN configuration.

According to the exhibit, if an internal user pings 10.1.100.2 and 10.1.100.22 from subnet 172.16.205.0/24, which outgoing interfaces will be used?

port16 and port1

port1 and port1

port16 and port15

port1 and port15

QUESTION 12
Review the VPN configuration shown in the exhibit.

What is the Forward Error Correction behavior if the SD-WAN network traffic download is 500 Mbps and has 8% of packet loss in the environment?

1 redundant packet for every 10 base packets

3 redundant packet for every 5 base packets

2 redundant packet for every 8 base packets

3 redundant packet for every 9 base packets

QUESTION 13
Refer to the exhibit, which shows a VPN topology.

The device IP 10.1.100.40 downloads a file from the FTP server IP 192.168.4.50 Referring to the exhibit, what will be the traffic flow behavior if ADVPN is configured in this environment?

All the session traffic will pass through the Hub

The TCP port 21 must be allowed on the NAT Device2

ADVPN is not supported when spokes are behind NAT

Spoke1 will establish an ADVPN shortcut to Spoke2

QUESTION 14
Refer to the exhibits.

A FortiGate cluster (CL-1) protects a data center hosting multiple web applications. A pair of FortiADC devices are already configured for SSL decryption (FAD-1), and re-encryption (FAD-2). CL-1 must accept unencrypted traffic from FAD-1, perform application detection on the plain-text traffic, and forward the inspected traffic to FAD-2.
The SSL-Offload-App-Detect application list and SSL-Offload protocol options profile are applied to the firewall policy handling the web application traffic on CL-1.
Given this scenario, which two configuration tasks must the administrator perform on CL-1? (Choose two.) A)

B)

Option A

Option B

Option C

Option D

QUESTION 15
Wh.ch feature must you enable on the BGP neighbors to accomplish this goal?

Graceful-restart

Deterministic-med

Synchronization

Soft-reconfiguration

QUESTION 16
Review the following FortiGate-6000 configuration excerpt:

Based on the configuration, which statement is correct regarding SNAT source port partitioning behavior?

It dynamically distributes SNAT source ports to operating FPCs or FPMs.

It is the default SNAT configuration and preserves active sessions when an FPC or FPM goes down.

It statically distributes SNAT source ports to operating FPCs or FPMs

It equally distributes SNAT source ports across chassis slots.

QUESTION 17
Refer to the exhibit showing FortiGate configurations

FortiManager VM high availability (HA) is not functioning as expected after being added to an existing deployment.
The administrator finds that VRRP HA mode is selected, but primary and secondary roles are greyed out in the GUI The managed devices never show online when FMG-B becomes primary, but they will show online whenever the FMG-A becomes primary.
What change will correct HA functionality in this scenario?

Change the FortiManager IP address on the managed FortiGate to 10.3.106.65.

Make the monitored IP to match on both FortiManager devices.

Unset the primary and secondary roles in the FortiManager CLI configuration so VRRP will decide who is primary.

Change the priority of FMG-A to be numerically lower for higher preference

QUESTION 18
On a FortiGate Configured in Transparent mode, which configuration option allows you to control Multicast traffic passing through the?

QUESTION 19
Which two methods are supported for importing user defined Lookup Table Data into the FortiSIEM? (Choose two.)

Report

FTP

API

SCP

QUESTION 20
Refer to the exhibits.

The exhibits show a FortiMail network topology, Inbound configuration settings, and a Dictionary Profile.
You are required to integrate a third-party’s host service (srv.thirdparty.com) into the e-mail processing path.
All inbound e-mails must be processed by FortiMail antispam and antivirus with FortiSandbox integration. If the email is clean, FortiMail must forward it to the third-party service, which will send the email back to FortiMail for final delivery, FortiMail must not scan the e-mail again.
Which three configuration tasks must be performed to meet these requirements? (Choose three.)

Change the scan order in FML-GW to antispam-sandbox-content.

Apply the Catch-Ail profile to the CFInbound profile and configure a content action profile to deliver to the srv. thirdparty. com FQDN

Create an access receive rule with a Sender value of srv. thirdparcy.com, Recipient value of *@acme.com, and action value of Safe

Apply the Catch-AII profile to the ASinbound profile and configure an access delivery rule to deliver to the 100.64.0.72 host.

Create an IP policy with a Source value of 100. 64 .0.72/32, enable precedence, and place the policy at the top of the list.

QUESTION 21
Refer to the exhibits.

A customer wants to deploy 12 FortiAP 431F devices on high density conference center, but they do not currently have any PoE switches to connect them to. They want to be able to run them at full power while having network redundancy From the FortiSwitch models and sample retail prices shown in the exhibit, which build of materials would have the lowest cost, while fulfilling the customer’s requirements?

1x FortiSwitch 248EFPOE

2x FortiSwitch 224E-POE

2x FortiSwitch 248E-FPOE

2x FortiSwitch 124E-FPOE

The customer wants to deploy 12 FortiAP 431F devices on a high density conference center, but they do not have any PoE switches to connect them to. They want to be able to run them at full power while having network redundancy. PoE switches are switches that can provide both data and power to connected devices over Ethernet cables, eliminating the need for separate power adapters or outlets. PoE switches are useful for deploying devices such as wireless access points, IP cameras, and VoIP phones in locations where power outlets are scarce or inconvenient. The FortiAP 431F is a wireless access point that supports PoE+ (IEEE 802.3at) standard, which can deliver up to 30W of power per port. The FortiAP 431F has a maximum power consumption of 25W when running at full power. Therefore, to run 12 FortiAP 431F devices at full power, the customer needs PoE switches that can provide at least 300W of total PoE power budget (25W x 12). The customer also needs network redundancy, which means that they need at least two PoE switches to connect the FortiAP devices in case one switch fails or loses power. From the FortiSwitch models and sample retail prices shown in the exhibit, the build of materials that has the lowest cost while fulfilling the customer’s requirements is 2x FortiSwitch 248E-FPOE. The FortiSwitch 248E-FPOE is a PoE switch that has 48 GE ports with PoE+ capability and a total PoE power budget of 370W. It also has 4x 10 GE SFP+ uplink ports for high-speed connectivity. The sample retail price of the FortiSwitch 248E-FPOE is $1,995, which means that two units will cost $3,990. This is the lowest cost among the other options that can meet the customer’s requirements. Option A is incorrect because the FortiSwitch 248EFPOE is a non-PoE switch that has no PoE capability or power budget. It cannot provide power to the FortiAP devices over Ethernet cables. Option B is incorrect because the FortiSwitch 224E-POE is a PoE switch that has only 24 GE ports with PoE+ capability and a total PoE power budget of 185W. It cannot provide enough ports or power to run 12 FortiAP devices at full power. Option D is incorrect because the FortiSwitch 124E-FPOE is a PoE switch that has only 24 GE ports with PoE+ capability and a total PoE power budget of 185W. It cannot provide enough ports or power to run 12 FortiAP devices at full power. Reference: https://www.fortinet.com/content/dam/fortinet/assets/data-sheets/FortiSwitch_Secure_Access_Series.pdf https://www.fortinet.com/content/dam/fortinet/assets/data-sheets/FortiAP_400_Series.pdf

QUESTION 22
A customer wants to use the FortiAuthenticator REST API to retrieve an SSO group called SalesGroup. The following API call is being made with the ‘curl’ utility:

Which two statements correctly describe the expected behavior of the FortiAuthenticator REST API? (Choose two.)

Only users with the “Full permission” role can access the REST API

This API call will fail because it requires that API version 2

If the REST API web service access key is lost, it cannot be retrieved and must be changed.

The syntax is incorrect because the API calls needs the get method.

QUESTION 23
Refer to the exhibit.

A customer has deployed a FortiGate 300E with virtual domains (VDOMs) enabled in the multi-VDOM mode. There are three VDOMs: Root is for management and internet access, while VDOM 1 and VDOM 2 are used for segregating internal traffic. AccountVInk and SalesVInk are standard VDOM links in Ethernet mode.
Given the exhibit, which two statements below about VDOM behavior are correct? (Choose two.)

You can apply OSPF routing on the VDOM link in either PPP or Ethernet mode

Traffic on AccountVInk and SalesVInk will not be accelerated.

The VDOM links are in Ethernet mode because they have IP addressed assigned on both sides.

Root VDOM is an Admin type VDOM, while VDOM 1 and VDOM 2 are Traffic type VDOMs.

OSPF routing can be configured between VDOM 1 and Root VDOM without any configuration changes to AccountVInk

QUESTION 24
A customer’s cybersecurity department needs to implement security for the traffic between two VPCs in AWS, but these belong to different departments within the company. The company uses a single region for all their VPCs.
Which two actions will achieve this requirement while keeping separate management of each department’s VPC? (Choose two.)

Create a transit VPC with a FortiGate HA cluster, connect to the other two using VPC peering, and use routing tables to force traffic through the FortiGate cluster.

Create an 1AM account for the cybersecurity department to manage both existing VPC, create a FortiGate HA Cluster on each VPC and IPSEC VPN to force traffic between the VPCs through the FortiGate clusters

Migrate all the instances to the same VPC and create 1AM accounts for each department, then implement a new subnet for a FortiGate auto-scaling group and use routing tables to force the traffic through the FortiGate cluster.

Create a VPC with a FortiGate auto-scaling group with a Transit Gateway attached to the three VPC to force routing through the FortiGate cluster

QUESTION 25
Which two methods are supported for importing user defined Lookup Table Data into the FortiSIEM? (Choose two.)

API

FTP

SCP

Report

QUESTION 26
Refer to the exhibit.

You have deployed a security fabric with three FortiGate devices as shown in the exhibit. FGT_2 has the following configuration:

FGT_1 and FGT_3 are configured with the default setting. Which statement is true for the synchronization of fabric-objects?

Objects from the FortiGate FGT_2 will be synchronized to the upstream FortiGate.

Objects from the root FortiGate will only be synchronized to FGT__2.

Objects from the root FortiGate will not be synchronized to any downstream FortiGate.

Objects from the root FortiGate will only be synchronized to FGT_3.

QUESTION 27
Refer to the exhibit.

A FortiWeb appliance is configured for load balancing web sessions to internal web servers. The Server Pool is configured as shown in the exhibit.
How will the sessions be load balanced between server 1 and server 2 during normal operation?

Server 1 will receive 25% of the sessions, Server 2 will receive 75% of the sessions

Server 1 will receive 20% of the sessions, Server 2 will receive 66.6% of the sessions

Server 1 will receive 33.3% of the sessions, Server 2 will receive 66 6% of the sessions

Server 1 will receive 0% of the sessions Server 2 will receive 100% of the sessions

QUESTION 28
An automation stitch was configured using an incoming webhook as the trigger named ‘my_incoming_webhook’. The action is configured to execute the CLI Script shown:

QUESTION 29
Refer to the exhibit containing the configuration snippets from the FortiGate. Customer requirements:

* SSLVPN Portal must be accessible on standard HTTPS port (TCP/443)
* Public IP address (129.11.1.100) is assigned to portl
* Datacenter.acmecorp.com resolves to the public IP address assigned to portl The customer has a Let’s Encrypt certificate that is going to expire soon and it reports that subsequent attempts to renew that certificate are failing.
Reviewing the requirement and the exhibit, which configuration change below will resolve this issue?
A)

B)

C)