Fortinet NSE8_811 問題集

質問 1：
Refer to the Exhibit button.
You need to run a script in FortiManager against managed FortiGate devices in your organization to install a configuration for a new static route. Which two scripts will successfully configure the static route on the managed device? (Choose two.)

A. Script 4
B. Script 2
C. Script 1
D. Script 3
正解：B,D

質問 2：
Exhibit

The exhibit shows a topology where a FortiGate is two VDOMS, root and vd-vlasn. The root VDCM provides SSL-VPN access, where the users authenticated by a FortiAuthenticatator. The vd-lan VDOM provids internal access to a Web server. For the remote users to access the internal web server, there are a few requirements, which are shown below.
--At traffic must come from the SSI-VPN
--The vd-lan VDOM only allows authenticated traffic to the Web server.
-- Users must only authenticate once, using the SSL-VPN portal.
-- SSL-VPN uses RADIUS-based authentication.
referring to the exhibit, and the requirement describe above, which two statements are true?
(Choose two.)
A. vd-lan authentication messages from root using FSSO.
B. root sends "RADIUS Accounting Messages" to FortiAuthenticator.
C. vd-lan connects to Fort authenticator as a regular FSSO client.
D. root is configured for FSSO while vd-lan is configuration for RSSO.
正解：B,C

質問 3：
A FortOS devices is used for termination of VPNs for number of remote spoke VPN units (designated group A spokes) using a phase 1 main mode dial-up tunnel using pre-shared. Your company recently acquired another organization. You are asked establish VPN correctively for the newly acquired organization's sites which new devices will be provisioned (designated Group B spokes). Both exiting (Group A) and new (Group B) spoke units are dynamically addressed. You are asked to ensure that spokes from the acquired organization (Group B) have different access permission than your existing VPN spokes (Group A).
Which two solutions meet the represents for the new spoke group? (Choose two.)
A. Implement a new phase 1 dial-up main mode tunnel with pre-shared keys and XAuth.
B. Implement separate phase 1 dial-up aggressive mode tunnels with a distinct peer ID.
C. Implement a new phase 1 dial-up main mode tunnel with certificate authentication.
D. Implement a new phase 1 dial-up main mode tunnel with a different pre-shared key than the Group A
spokes.
正解：A,B

質問 4：
Your client wants to use a central RADIUS server for management authentication when connecting to the FortiGate GUL and provide different levels of access for different types of employees.
Which three actions required providing the requested functionality? (Choose three.)
A. Enable radius-vdom-override in the CLI.
B. Enable accprofile-override in the CLI.
C. Create multiple administrator profiles with matching RADIUS VSAs.
D. Create a wildcard administrator on the FortiGate.
E. Set the RADIUS authentication type to MS-CHAPv2.
正解：B,C,D
解説: (Topexam メンバーにのみ表示されます)

質問 5：
Click the exhibit.
You created an aggregate interface between your FortiGate and a switch consisting of two 1 Gbps links as shown in the exhibit. However, the maximum bandwidth never exceeds. 1 Gbps and employees are complaining that the network is slow. After troubleshooting, you notice only one member interface is being used. The configuration for the aggregate interface is shown in the exhibit.
In this scenario, which command will solve this problem?

A. config system interface
edit Agg1
set weight 2
end
B. config system interface
edit Agg1
set lacp-mode active
end
C. config system interface
edit Agg1
set Algorithm L4
end
D. config system interface
edit Agg1
set min-links 2
end
正解：C

質問 6：
Refer to the exhibit.

The exhibit shows a full-mesh topology between FortiGate and FortiSwitch devices. To deploy this configuration, two requirements must be met:
* 20 Gbps full duplex connectivity is available between each FortiGate and the FortiSwitch devices
* The FortiGate HA must be in AP mode
Referring to the exhibit, what are two actions that will fulfill the requirements? (Choose two.)
A. Configure the master FortiGate with one LAG and FortiLink split interface disabled on ports connected to cables A and C and make sure the same ports are used for cables B and D on the slave.
B. Configure both FortiSwitch devices as peers with ICL over cable E, create one MCLAG on ports connected to cables A and C, and create another MCLAG on ports connected to cables B and D.
C. Configure the master FortiGate with one LAG and FortiLink split interface enabled on ports connected to cables A and C and make sure the same ports are used for cables B and D on the slave.
D. Configure both FortiSwitch devices as peers with ISL over cable E, create one MCLAG on ports connected to cables A and C, and create another MCLAG on ports connected to cables B and D.
正解：A,B