Fortinet NSE8_812 問題集

質問 1：
Refer to the exhibit showing a firewall policy configuration.

To prevent unauthorized access of their cloud assets, an administrator wants to enforce authentication on firewall policy ID 1.
What change does the administrator need to make?

A. Option A
B. Option C
C. Option D
D. Option B
正解：A
解説: (Topexam メンバーにのみ表示されます)

質問 2：
Refer to the exhibit.

An HTTPS access proxy is configured to demonstrate its function as a reverse proxy on behalf of the web server it is protecting. It verifies user identity, device identity, and trust context, before granting access to the protected source. It is assumed that the FortiGate EMS fabric connector has already been successfully connected.
You need to ensure that ZTNA access through the FortiGate will redirect users to the FortiAuthenticator to perform username/password and multifactor authentication to validate access prior to accessing resources behind the FortiGate.
In this scenario, which two further steps need to be taken on the FortiGate? (Choose two.)
A. Create a firewall rule that allows access from the remote endpoint to the resources behind the FortiGate.
B. Create an authentication rule that sets the sso-auth-method to the FortiAuthenticator.
C. Create an authentication scheme with the "method" as SAML.
D. Create a SAML user/server object referring to the FortiAuthenticator.
正解：C,D

質問 3：
Refer to the exhibit, which shows a multi-region SD-WAN architecture.

Given this scenario, which two statements are true? (Choose two.)
A. If iBGP is used, cross-regional spoke-to-hub shortcuts cannot be used.
B. If eBGP is used, ADVPN can be established only for branch-to-branch traffic within each region.
C. If iBGP is used, cross-regional spoke-to-hub shortcuts can be established.
D. If eBGP is used, ADVPN can be established for branch-to-branch traffic across regions.
正解：B

質問 4：
You want to use the MTA adapter feature on FortiSandbox in an HA-Cluster. Which statement about this solution is true?
A. The MTA adapter mode is only detection mode.
B. The configuration of the MTA Adapter Local Interface is different than on port1.
C. The configuration is different than on a standalone device.
D. The MTA adapter is only available in the primary node.
正解：D
解説: (Topexam メンバーにのみ表示されます)

質問 5：
Refer to the CLI configuration of an SSL inspection profile from a FortiGate device configured to protect a web server:

Based on the information shown, what is the expected behavior when an HTTP/2 request comes in?
A. FortiGate will strip the ALPN header and forward the traffic.
B. FortiGate will reject all HTTP/2 ALPN headers.
C. FortiGate will rewrite the ALPN header to request HTTP/1.
D. FortiGate will forward the traffic without modifying the ALPN header.
正解：A
解説: (Topexam メンバーにのみ表示されます)

質問 6：
You are troubleshooting a FortiMail Cloud service integrated with Office 365 where outgoing emails are not reaching the recipients' mail What are two possible reasons for this problem? (Choose two.)
A. The FortiMail DKIM key was not set using the Auto Generation option.
B. A Mail Flow connector from the Exchange Admin Center has not been set properly to the FortiMail Cloud FQDN.
C. The FortiMail access control rules to relay from Office 365 servers public IPs are missing.
D. The FortiMail access control rule to relay from Office 365 servers FQDN is missing.
正解：C,D
解説: (Topexam メンバーにのみ表示されます)

質問 7：
Refer to the exhibit, which shows diagnostic output.

A customer reports that ICMP traffic flow from 192.168.1.11 to 93.190.134.171 is not corresponding to the SD-WAN setup.
What is the problem in this scenario?
A. Port1 is used because it has more available bandwidth.
B. Traffic is matched by policy route.
C. Route for the destination IP is missing in the routing table.
D. SD-WAN Rule is matching only DNS traffic.
正解：B