Fortinet NSE8_811 問題集

質問 1：
Click the Exhibit button.

Click the Exhibit button.
A FortiGate with the default configuration is deployed between two IP phones. FortiGate receives the INVITE request shown in the exhibit form Phone A (internal)to Phone B (external). Which two actions are taken by the FortiGate after the packet is received? (Choose two.)
A. a pinhole will be opened to accept traffic sent to FortiGate's WAN IP address and ports 49l70 and 49171.
B. The phone A IP address will be translated lo the WAN IP address in all INVITE header fields and the m: field of the SDP statement.
C. The phone A IP address will be translated for the WAN IP address in all INVITE header fields and the SDP statement remains intact.
D. A pinhole will be opened to accept traffic sent to FortiGate's WAN IP address and ports 49169 and 49170.
正解：A,B
解説: (Topexam メンバーにのみ表示されます)

質問 2：
You configured a firewall policy with only a Web filter profile for accessing the Internet. Access to websites belonging to the "Information Technology" category are blocked and to the "Business" category are allowed. SSL deep inspection is not enabled on this policy.
A user wants to access the website https://www.it-acme.com which presents a certificate with CN=www.acme.com. The it-acme.com domain is categorized as "Information Technology" and the acme.com domain is categorized as "Business".
Which statement regarding this scenario is correct?
A. The website will be blocked by category "Information Technology" as the SNI takes precedence over the certificate name.
B. Only with SSL deep inspection enabled will the FortiGate be able to categorized this website.
C. The website will be allowed by category "Business" as the certificate name takes precedence over the
URL.
D. The FortiGate is able to read the URL within HTTPS sessions when using SSL certificate inspection so the website will be blocked by the "Information Technology".
正解：A

質問 3：
Exhibit

An Administrator reports continuous high CPU utilization on a FortiGate device due to the IPS engine. The exhibit shows the global IPS configuration. Which two configuration actions will reduce the CPU usage? (Choose two.)
A. Reduce the number of packets logged.
B. Enable intelligent mode.
C. Change the algorithm to low.
D. Disable fail open.
正解：A,B

質問 4：
Click the exhibit button.
A FortiGate device is configured to authenticate SSL VPN users using digital certificates. Part of the FortiGate configuration is shown in the exhibit.
Which two statements are true in this scenario? (Choose two.)

A. The authentication will fail if the certificate does not contain user principle name (UPN) information.
B. The authentication will fail if the OCSP server is down.
C. OCSP is used to verify that the user-signed certificate has not expired.
D. The authentication will fail if the user certificate does not contain the CA_Cert string in the Failed.
正解：A,B
解説: (Topexam メンバーにのみ表示されます)

質問 5：
Your client wants to use a central RADIUS server for management authentication when connecting to the FortiGate GUL and provide different levels of access for different types of employees.
Which three actions required providing the requested functionality? (Choose three.)
A. Enable radius-vdom-override in the CLI.
B. Enable accprofile-override in the CLI.
C. Create multiple administrator profiles with matching RADIUS VSAs.
D. Create a wildcard administrator on the FortiGate.
E. Set the RADIUS authentication type to MS-CHAPv2.
正解：B,C,D
解説: (Topexam メンバーにのみ表示されます)

質問 6：
In a FortiGate 5000 series, two FortiControllers are working as an SLBC cluster in a-p mode. The configuration shown below is applied.
config load-balance session-setup
set tcp-ingress enable
end
When statement is true on how new TCP sessions are handled by the Distributor Processor (DP)?
A. A new session added m the DP session table remains in the table remain in the traffic is denied by the procession worker.
B. No new session is added is the DP session table until the processing worker accepts the traffic.
C. The new session added the DP session table is automatically deleted, if the traffic is denied by the processing worker.
D. A new session added in the OP session table remains is the table only if traffic is traffic is accepted by the processing worker.
正解：A

質問 7：
Exhibit
Click the Exhibit button.
You have deployed several perimeter FortiGates with internal segmentation FortiGates behind them. All FortiGate devices are logging to FortiAnalyzer. When you search the logs in FortiAnalyzer for denied traffic, you see numerous log messages, as shown in the exhibit, on your perimeter FortiGates only.

Which two actions would reduce the number of these log messages? (Choose two.)
A. Apply an application control profile lo the perimeter FortiGates that does not inspect DNS traffic to the outbound firewall policy.
B. Configure the internal ForbGates to communicate to ForpGuard using port 8888.
C. Disable DNS events logging horn ForirGate In the config log fortianalyser filter section.
D. Remove DNS signature* <rom the IPS protte appfced to the outbound firewall policy.
正解：B,C
解説: (Topexam メンバーにのみ表示されます)