Fortinet NSE8 問題集

質問 1：
Your NOC contracts the security team due to a problem with a new application flow. You are instructed to
disable hardware acceleration for the policy shown in the exhibit for troubleshooting purposes.
Which command will disable hardware acceleration for the new application policy?

A:

B:

C:

D:

A. Option A
B. Option C
C. Option D
D. Option B
正解：C

質問 2：
Which three configuration scenarios will result in an IPsec negotiation failure between two FortiGate
devices? (Choose three.)
A. failed Dead Peer Detection negotiation
B. mismatched phase 2 selectors
C. mismatched IKE version
D. mismatched Anti-Replay configuration
E. mismatched Perfect Forward Secrecy
正解：E

質問 3：
You notice that your FortiGate's memory usage is very high and that the unit's performance is adversely affected. You want to reduce memory usage.
Which three commands would meet this requirement? (Choose three.)
A:

B:

C:

D:

E:

A. Option E
B. Option A
C. Option C
D. Option D
E. Option B
正解：A,B,D

質問 4：
Which two features are supported only by FortiMail but not by FortiGate? (Choose two.)
A. end-to-end IBE encryption
B. FortiGuard Antispam
C. built-in MTA
D. DNSBL
正解：C,D

質問 5：
Your company uses a cluster of two FortiGate 3600C units in active-passive mode to protect the
corporate network. The FortiGate cluster sends its logs to a FortiAnalyzer and you have configured
scheduled weekly reports for the Internet bandwidth usage of each corporate VLAN. During a scheduled
maintenance window, you make a series of configuration changes. When the next FortiAnalyzer weekly
report is generated, you notice that Internet bandwidth usage reported by the FortiAnalyzer is far less than
expected.
What is the reason for this discrepancy?
A. You applied an antivirus profile on some of the policies, and no traffic can be accelerated.
B. You disabled all security profiles on some of the firewall policies, and the traffic matching those policies
is now accelerated.
C. You changed from active-passive to active-active, causing the session traffic counters to become
inaccurate.
D. You enabled HA session-pickup, which is turn disabled session accounting.
正解：C

質問 6：
A customer wants to implement a RADIUS Single Sign On (RSSO) solution for multiple FortiGate devices.
The customer's network already includes a RADIUS server that can generate the logon and logoff accounting records.
However, the RADIUS server can send those records to only one destination.
What should the customer do to overcome this limitation?
A. Use the RADIUS accounting proxy feature available in FortiAuthenticator devices.
B. Send the RADIUS records to an RSSO Collector Agent.
C. Send the RADIUS records to one of the FortiGate devices, which can replicate them to the other FortiGate units.
D. Send the RADIUS records to an LDAP server and add the LDAP server to the FortiGate configuration .
正解：B