How to pass Fortinet NSE8_812 exam with the help of dumps?

Question # 1

An automation stitch was configured using an incoming webhook as the trigger named 'my_incoming_webhook'. The action is configured to execute the CLI Script shown:

A. Option A 
B. Option B 
C. Option C 
D. Option D 

Show Answer

Question # 2

Review the VPN configuration shown in the exhibit. What is the Forward Error Correction behavior if the SD-WAN network traffic download is 500 Mbps and has 8% of packet loss in the environment?

A. 1 redundant packet for every 10 base packets 
B. 3 redundant packet for every 5 base packets 
C. 2 redundant packet for every 8 base packets 
D. 3 redundant packet for every 9 base packets 

Show Answer

Question # 3

Refer to the CLI configuration of an SSL inspection profile from a FortiGate device configured to protect a web server: Based on the information shown, what is the expected behavior when an HTTP/2 request comes in?

A. FortiGate will reject all HTTP/2 ALPN headers. 
B. FortiGate will strip the ALPN header and forward the traffic. 
C. FortiGate will rewrite the ALPN header to request HTTP/1. 
D. FortiGate will forward the traffic without modifying the ALPN header. 

Show Answer

Question # 4

What is the benefit of using FortiGate NAC LAN Segments?

A. It provides support for multiple DHCP servers within the same VLAN. 
B. It provides physical isolation without changing the IP address of hosts. 
C. It provides support for IGMP snooping between hosts within the same VLAN 
D. It allows for assignment of dynamic address objects matching NAC policy. 

Show Answer

Question # 5

Refer to the exhibit. A customer has deployed a FortiGate 300E with virtual domains (VDOMs) enabled in the multi-VDOM mode. There are three VDOMs: Root is for management and internet access, while VDOM 1 and VDOM 2 are used for segregating internal traffic. AccountVInk and SalesVInk are standard VDOM links in Ethernet mode. Given the exhibit, which two statements below about VDOM behavior are correct? (Choose two.)

A. You can apply OSPF routing on the VDOM link in either PPP or Ethernet mode
B. Traffic on AccountVInk and SalesVInk will not be accelerated.
C. The VDOM links are in Ethernet mode because they have IP addressed assigned on both sides.
D. Root VDOM is an Admin type VDOM, while VDOM 1 and VDOM 2 are Traffic type VDOMs.
E. OSPF routing can be configured between VDOM 1 and Root VDOM without any configuration changes to AccountVInk

Show Answer

Question # 6

Refer to the exhibits. A customer has deployed a FortiGate with iBGP and eBGP routing enabled. HQ is receiving routes over eBGP from ISP 2; however, only certain routes are showing up in the routing table-Assume that BGP is working perfectly and that the only possible modifications to the routing table are solely due to the prefix list that is applied on HQ. Given the exhibits, which two routes will be active in the routing table on the HQ firewall? (Choose two.)

A. 172.16.204.128/25 
B. 172.16.201.96/29 
C. 172,620,64,27 
D. 172.16.204.64/27

Show Answer

Question # 7

Refer to the exhibits. A customer is looking for a solution to authenticate the clients connected to a hardware switch interface of a FortiGate 400E. Referring to the exhibits, which two conditions allow authentication to the client devices before assigning an IP address? (Choose two.)

A. FortiGate devices with NP6 and hardware switch interfaces cannot support 802.1X authentication.
B. Devices connected directly to ports 3 and 4 can perform 802 1X authentication. 
C. Ports 3 and 4 can be part of different switch interfaces. 
D. Client devices must have 802 1X authentication enabled

Show Answer

Question # 8

A customer is planning on moving their secondary data center to a cloud-based laaS. They want to place all the Oracle-based systems Oracle Cloud, while the other systems will be on Microsoft Azure with ExpressRoute service to their main data center. They have about 200 branches with two internet services as their only WAN connections. As a security consultant you are asked to design an architecture using Fortinet products with security, redundancy and performance as a priority. Which two design options are true based on these requirements? (Choose two.)

A. Systems running on Azure will need to go through the main data center to access the services on Oracle Cloud.
B. Use FortiGate VM for IPSEC over ExpressRoute, as traffic is not encrypted by Azure.
C. Branch FortiGate devices must be configured as VPN clients for the branches' internal network to be able to access Oracle services without using public IPs.
D. Two ExpressRoute services to the main data center are required to implement SD-WAN between a FortiGate VM in Azure and a FortiGate device at the data center edge

Show Answer

Question # 9

Refer to the exhibit showing the history logs from a FortiMail device. Which FortiMail email security feature can an administrator enable to treat these emails as spam?

A. DKIM validation in a session profile 
B. Sender domain validation in a session profile 
C. Impersonation analysis in an antispam profile 
D. Soft fail SPF validation in an antispam profile

Show Answer

Question # 10

A customer with a FortiDDoS 200F protecting their fibre optic internet connection from incoming traffic sees that all the traffic was dropped by the device even though they were not under a DoS attack. The traffic flow was restored after it was rebooted using the GUI. Which two options will prevent this situation in the future? (Choose two)

A. Change the Adaptive Mode. 
B. Create an HA setup with a second FortiDDoS 200F 
C. Move the internet connection from the SFP interfaces to the LC interfaces 
D. Replace with a FortiDDoS 1500F

Show Answer

Question # 11

Refer to the exhibit showing a FortiSOAR playbook. You are investigating a suspicious e-mail alert on FortiSOAR, and after reviewing the executed playbook, you can see that it requires intervention. What should be your next step?

A. Go to the Incident Response tasks dashboard and run the pending actions
B. Click on the notification icon on FortiSOAR GUI and run the pending input action 
C. Run the Mark Drive by Download playbook action 
D. Reply to the e-mail with the requested Playbook action  

Show Answer

Question # 12

A retail customer with a FortiADC HA cluster load balancing five webservers in L7 Full NAT mode is receiving reports of users not able to access their website during a sale event. But for clients that were able to connect, the website works fine. CPU usage on the FortiADC and the web servers is low, application and database servers are still able to handle more traffic, and the bandwidth utilization is under 30%. Which two options can resolve this situation? (Choose two.)

A. Change the persistence rule to LB_PERSIS_SSL_SESSJD. 
B. Add more web servers to the real server poof 
C. Disable SSL between the FortiADC and the web servers 
D. Add a connection-pool to the FortiADC virtual server

Show Answer

Question # 13

Refer to the exhibit.You have been tasked with replacing the managed switch Forti Switch 2 shown in the topology. Which two actions are correct regarding the replacement process? (Choose two.)

A. After replacing the FortiSwitch unit, the automatically created trunk name does not change
B. CLAG-ICL needs to be manually reconfigured once the new switch is connected to the FortiGate
C. After replacing the FortiSwitch unit, the automatically created trunk name changes. 
D. MCLAG-ICL will be automatically reconfigured once the new switch is connected to the FortiGate.

Show Answer

Question # 14

Review the following FortiGate-6000 configuration excerpt: Based on the configuration, which statement is correct regarding SNAT source port partitioning behavior?

A. It dynamically distributes SNAT source ports to operating FPCs or FPMs.
B. It is the default SNAT configuration and preserves active sessions when an FPC or FPM goes down.
C. It statically distributes SNAT source ports to operating FPCs or FPMs 
D. It equally distributes SNAT source ports across chassis slots. 

Show Answer

Question # 15

Refer to the exhibit. To facilitate a large-scale deployment of SD-WAN/ADVPN with FortiGate devices, you are tasked with configuring the FortiGate devices to support injecting of IKE routes on the ADVPN shortcut tunnels. Which three commands must be added or changed to the FortiGate spoke config vpn ipsec phasei-interface options referenced in the exhibit for the VPN interface to enable this capability? (Choose three.)

A. set net-device disable 
B. set mode-cfg enable 
C. set ike-version 1 
D. set add-route enable 
E. set mode-cfg-allow-client-selector enable 

Show Answer

Question # 16

You are creating the CLI script to be used on a new SD-WAN deployment You will have branches with a different number of internet connections and want to be sure there is no need to change the Performance SLA configuration in case more connections are added to the branch. The current configuration is: Which configuration do you use for the Performance SLA members?

A. set members any 
B. set members 0 
C. current configuration already fulfills the requirement 
D. set members all 

Show Answer

Question # 17

Refer to the exhibits. The exhibits show a FortiMail network topology, Inbound configuration settings, and a Dictionary Profile. You are required to integrate a third-party's host service (srv.thirdparty.com) into the e-mail processing path. All inbound e-mails must be processed by FortiMail antispam and antivirus with FortiSandbox integration. If the email is clean, FortiMail must forward it to the third-party service, which will send the email back to FortiMail for final delivery, FortiMail must not scan the e-mail again. Which three configuration tasks must be performed to meet these requirements? (Choose three.)

A. Change the scan order in FML-GW to antispam-sandbox-content.
B. Apply the Catch-Ail profile to the CFInbound profile and configure a content action profile to deliver to the srv. thirdparty. com FQDN
C. Create an access receive rule with a Sender value of srv. thirdparcy.com, Recipient value of *@acme.com, and action value of Safe
D. Apply the Catch-AII profile to the ASinbound profile and configure an access delivery rule to deliver to the 100.64.0.72 host.
E. Create an IP policy with a Source value of 100. 64 .0.72/32, enable precedence, and place the policy at the top of the list.

Show Answer

Question # 18

Refer to the exhibit showing an SD-WAN configuration. According to the exhibit, if an internal user pings 10.1.100.2 and 10.1.100.22 from subnet 172.16.205.0/24, which outgoing interfaces will be used?

A. port16 and port1 
B. port1 and port1
C. port16 and port15 
D. port1 and port15 

Show Answer

Question # 19

Refer to the exhibit. You are operating an internal network with multiple OSPF routers on the same LAN segment. FGT_3 needs to be added to the OSPF network and has the configuration shown in the exhibit. FGT_3 is not establishing any OSPF connection. What needs to be changed to the configuration to make sure FGT_3 will establish OSPF neighbors without affecting the DR/BDR election?

A. Option A  
B. Option B 
C. Option C 
D. Option D

Show Answer

Question # 20

SD-WAN is configured on a FortiGate. You notice that when one of the internet links has high latency the time to resolve names using DNS from FortiGate is very high. You must ensure that the FortiGate DNS resolution times are as low as possible with the least amount of work. What should you configure?

A. Configure local out traffic to use the outgoing interface based on SD-WAN rules with a manual defined IP associated to a loopback interface and configure an SD-WAN rule from the loopback to the DNS server.
B. Configure an SD-WAN rule to the DNS server and use the FortiGate interface IPs in the source address.
C. Configure two DNS servers and use DNS servers recommended by the two internet providers.
D. Configure local out traffic to use the outgoing interface based on SD-WAN rules with the interface IP and configure an SD-WAN rule to the DNS server.

Show Answer

Question # 21

Refer to the exhibits.A FortiGate cluster (CL-1) protects a data center hosting multiple web applications. A pair of FortiADC devices are already configured for SSL decryption (FAD-1), and re-encryption (FAD-2). CL-1 must accept unencrypted traffic from FAD-1, perform application detection on the plain-text traffic, and forward the inspected traffic to FAD-2. The SSL-Offload-App-Detect application list and SSL-Offload protocol options profile are applied to the firewall policy handling the web application traffic on CL-1. Given this scenario, which two configuration tasks must the administrator perform on CL-1? (Choose two.) A)

A. Option A 
B. Option B 
C. Option C 
D. Option D

Show Answer