File Info
| Exam | Fortinet NSE 8 - Written Exam |
| Number | NSE8_812 |
| File Name | Fortinet.NSE8_812.PassLeader.2025-02-28.61q.tqb |
| Size | 226 KB |
| Posted | Feb 28, 2025 |
| Download | Fortinet.NSE8_812.PassLeader.2025-02-28.61q.tqb |
How to open VCEX & EXAM Files?
Files with VCEX & EXAM extensions can be opened by ProfExam Simulator.
Coupon: MASTEREXAM
With discount: 20%
Demo Questions
Question 1
A cafe offers free Wi-Fi. Customers' portable electronic devices often do not have antivirus software installed and may be hosting worms without their knowledge. You must protect all customers from any other customers' infected devices that join the same SSID. Which step meets the requirement?
- Enable deep SSH inspection with antivirus and IPS.
- Use a captive portal to redirect unsecured connections such as HTTP and SMTP to their secured equivalents, preventing worms on infected clients from tampering with other customer traffic.
- Use WPA2 encryption and configure a policy on FortiGate to block all traffic between clients.
- Use WPA2 encryption, and enable "Block lntra-SSID Traffic".
Correct answer: D
Question 2
You verified that application control is working from previous configured categories. You just added Skype on blocked signatures. However, after applying the profile to your firewall policy, clients running Skype can still connect and use the application. What are two causes of this problem? (Choose two.)
- The application control database is not updated.
- SSL inspection is not enabled.
- A client on the network was already connected to the Skype network and serves as relay prior to configuration changes to block Skype.
- The FakeSkype.botnet signature is included on your application control sensor.
Correct answer: AB
Question 3
You are an administrator of FortiGate devices that use FortiManager for central management. You need to add a policy on an ADOM, but upon selecting the ADOM drop-down list, you notice that the ADOM is in locked state. Workflow mode is enabled on your FortiManager to define approval or notification workflow when creating and installing policy changes. What caused this problem?
- Another administrator has locked the ADOM and is currently working on it.
- There is pending approval waiting from a previous modification.
- You need to use set workspace-mode workflow on the CLI.
- You have read-only permission on Workflow Approve in the administrator profile.
Correct answer: A
Question 4
You are asked to design a secure solution using Fortinet products for a company. The company recently has Web servers that were exploited and defaced. The customer has also experienced Denial or Service due to SYN Flood attacks. Taking this into consideration, the customer's solution should have the following requirements:
- management requires network-based content filtering with man-in-the-middle inspection
- the customer has no existing public key infrastructure but requires centralized certificate management
- users are tracked by their active directory username without installing any software on their hosts
- Web servers that have been exploited need to be protected from the OW ASP Top 10
- notification of high volume SYN Flood attacks when a threshold has been triggered
Which three solutions satisfy these requirements? (Choose three.)
- FortiGate
- FortiCiient
- FortiWeb
- FortiAuthenticator
- FortiDDOS
Correct answer: CDE
Question 5
A customer has the following requirements:
- local peer with two Internet links
- remote peer with one Internet link
- secure traffic between the two peers
- granular control with Accept policies
Which solution provides security and redundancy for traffic between the two peers?
- a fully redundant VPN with interface mode configuration
- a partially redundant VPN with interface mode configuration
- a partially redundant VPN with tunnel mode configuration
- a fully redundant VPN with tunnel mode configuration
Correct answer: B
Question 6
Regarding tunnel-mode SSL VPN, which three statements are correct? (Choose three.)
- Split tunneling is supported.
- It requires the installation of a VPN client.
- It requires the use of an Internet browser.
- It does not support traffic from third-party network applications.
- An SSL VPN IP address is dynamically assigned to the client by the FortiGate unit.
Correct answer: ABE
Question 7
You are managing a FortiAnalyzer appliance. After an upgrade, you notice that the unit no longer displays historical logs, reports do not produce any data, and FortiView summary views are empty.
However, you notice that the unit is receiving logs on the dashboard widgets. Which step resolves this problem?
- Execute the CLI command exec sql-local rebuild-db.
- Execute the CLI command diag sql remove hcache.
- Execute the CLI command exec sql-local reinsert-logs.
- Restore the unit settings from a previous backup.
Correct answer: A
Question 8
You have received an issue report about users not being able to use a video conferencing application. This application uses two UDP ports and two TCP ports to communicate with servers on the Internet. The network engineering team has confirmed there is no routing problem. You are given a copy of the FortiGate configuration. Which three configuration objects will you inspect to ensure that no policy is blocking this traffic? (Choose three.)
- config firewall interface-policy
- config firewall DoS-policy
- config firewall policy
- config firewall multicast-policy
- config firewall sniffer-policy
Correct answer: ABC
Question 9
You implemented FortiGate in transparent mode with 10 different VLAN interfaces in the same forwarding domain. You have defined a policy to allow traffic from any interface to any interface. Which statement about your implementation is true?
- FortiGate populates the MAC address table based on destination addresses of frames received from all10 VLANs.
- There will be no impact on the STP protocol.
- All10 VLANs will become a single broadcast domain for the ARP request.
- The ARP request will not be forwarded across the different VLANs domains.
Correct answer: C
Question 10
A customer wants to implement a RADIUS Single Sign On (RSSO) solution for multiple FortiGate devices. The customer's network already includes a RADIUS server that can generate the logon and logoff accounting records. However, the RADIUS server can send those records to only one destination. What should the customer do to overcome this limitation?
- Send the RADIUS records to an LDAP server and add the LDAP server to the FortiGate configuration.
- Send the RADIUS records to an RSSO Collector Agent.
- Send the RADIUS records to one of the FortiGate devices, which can replicate them to the other FortiGate units.
- Use the RADIUS accounting proxy feature available in FortiAuthenticator devices.
Correct answer: B
