Fortinet NSE8_810 問題集

質問 1：
You configure an outgoing firewall policy with a web filter for accessing the internet. The access to URL
https// itacm.co and web belonging to the same category should be blocked. You notice that the Web server presents a certificate with CN=www acme.com. The www.it.acme site is as '' information Technology and the www.acme.com site is categorized as ''Business".
Which statements is correct in this scenario?
A. Category "information Technology" needs to blocked, the FortiGate is able to inspection the URL with HTTPS sessions.
B. Category "Business" need a to be block: the certificate name takes precedence over the SNI.
C. SSL inspection must be configured to deep-inspection: the category "information Technology "needs to be blocked.
D. Category :information Technology" needs to be blocked, the SNI takes precedence over the certificate name.
正解：D
解説: (Topexam メンバーにのみ表示されます)

質問 2：
Click the Exhibit button.

Referring to the exhibit, which two statements are true? (Choose two.)
A. LAG-1 and LAG 2 should be connected to a single 4-port 802 3ad interface on the FortiGate-A.
B. LAG-3 on switches on FS448D-A and FS448D-B may be connected to a single 802 3ad trunk on another device.
C. port13 and port14 on FS448D-A should be connected to port13 and port14 on FS448D-B.
D. LAG-1 and LAG-2 should be connected to a 4-port single 802 3ad trunk on another device.
正解：B,C

質問 3：
You have a customer with a SCADA environmental control devices that is trigged a false-positive OPS alert whenever the device's Web GUI is accessed. You cannot seem to create a functional custom IPS filter expert this behavior, and it appears that the device is so old that it does HTTPS support. You need to prevent the false posited IPS alert occurring.
In this scenario, which two actions would accomplish this task? (Choose two.)
A. Change the relevant firewall policies to use SSL certificate-inspection instead of SSL deep-inspection.
B. Create a very granular firewall for that device's IP address which does not perform IPS scanning.
C. Reconfigure the FortiGate to operate in proxy-based inspection mode instead of flow-based.
D. Create a URL filter with the exempt action for that device's IP address.
正解：A,B

質問 4：
Refer to the Exhibit button.
You need to run a script in FortiManager against managed FortiGate devices in your organization to install a configuration for a new static route. Which two scripts will successfully configure the static route on the managed device? (Choose two.)

A. Script 4
B. Script 2
C. Script 1
D. Script 3
正解：B,D

質問 5：
Exhibit

Your organization has a FortrGate cluster that is connected to two independent ISPs. You must configure the FortiGate failover for a single ISP failure to occur without disruption.
Referring to the exhibit, which two FortiGate BGP features would be used to accomplish this task' (Choose two.)
A. Enable synchronization
B. Enable graceful restart
C. Enable BFD
D. Enable EBGP multipath
正解：B,C

質問 6：
Exhibit

An Administrator reports continuous high CPU utilization on a FortiGate device due to the IPS engine. The exhibit shows the global IPS configuration. Which two configuration actions will reduce the CPU usage?
(Choose two.)
A. Reduce the number of packets logged.
B. Enable intelligent mode.
C. Change the algorithm to low.
D. Disable fail open.
正解：A,B