NSE8_811 Online Practice Questions and Answers

Refer to the exhibit.

The exhibit shows the steps for creating a URL rewrite policy on a FortiWeb. Which statement represents the purpose of this policy?

A. The policy redirects all HTTPS URLs to HTTP.

B. The policy redirects all HTTP URLs to HTTPS.

C. The policy redirects only HTTP URLs containing the ^/(.*)$ string to HTTPS.

D. The policy redirects only HTTPS URLs containing the ^/(.*)$ string to HTTP.

A customer wants to integrate their on-premise FortiGate with their Azure infrastructure.

Which two components must be in place to configure the Azure Fabric connector? (Choose two.)

A. FortiGate-VM virtual appliance deployed on-premise.

B. An inbound policy from the Azure FortiGate-VM virtual appliance.

C. An outbound policy from the Azure FortiGate-VM virtual appliance.

D. A FortiGate-VM virtual appliance deployed in Azure.

You cannot ping the FortiGate default gateway 10.10.10.1 from the FortiGate CLI. The FortiGate interface facing the default gateway is wan1 and its IP address is 10.10.10.254/24. During the initial troubleshooting tests, you confirm that you can ping other IP addresses in the 10.10.10.0/24 subnet from the FortiGate CLI without packets lost.

Which two CLI commands will help you to troubleshoot this problem? (Choose two.)

A. diagnose debug flow filter saddr 10.10.10.1 diagnose debug flow trace start 10

B. diagnose hardware deviceinfo nic wan1

C. diagnose ip arp list

D. diag sniffer packet wan1 'arp and host 10.10.10.1'

An organization has one central site and three remote sites. A FortiSIEM has been installed on the central site and now all devices across the remote sites must be centrally monitored by the FortiSIEM at the central site.

Which action will reduce the WAN usage by the monitoring system?

A. Enable SD-WAN FEC (Forward Error Correction) on the FortiGate at the remote site.

B. Install both Supervisor and Collector on each remote site.

C. Install local Collectors on each remote site.

D. Disable real-time log upload on the remote sites.

A customer is looking for a way to remove javascripts, macros and hyperlinks from documents traversing the network without affecting the integrity of the content. You propose to use the Content disarm and reconstruction (CDR) feature of the FortiGate.

Which two considerations are valid to implement CDR in this scenario? (Choose two.)

A. The inspection mode of the FortiGate is not relevant for CDR to operate.

B. CDR is supported on HTTPS, SMTPS, and IMAPS if deep inspection is enabled.

C. CDR can only be performed on Microsoft Office Document and PDF files.

D. Files processed by CDR can have the original copy quarantined on the FortiGate.

Consider the following configuration setting:

Which two statements about local authentication are true? (Choose two.)

A. The FortiGate will allow the TCP connection when a ClientHello message indicating a renegotiation is received.

B. The user's IP address will be blocked 15 seconds after five login failures.

C. The user will be blocked 15 seconds after five login failures.

D. The user will need to re-authenticate after five minutes.

You must create a High Availability deployment with two FortiWebs in Amazon Web Services (AWS); each on different Availability Zones (AZ) from the same region. At the same time, each FortiWeb should be able to deliver content from the Web servers of both of the AZs.

Which deployment would fulfill this requirement?

A. Configure the FortiWebs in Active-Active HA mode and use AWS Elastic Load Balancer (ELB) for the internal Web servers.

B. Use AWS Elastic Load Balancer (ELB) for both the FortiWebs in standalone mode and the internal Web servers in an ELB sandwich.

C. Configure the FortiWebs in Active-Active HA mode and use AWS Route 53 to load balance the internal Web servers.

D. Use AWS Route 53 to load balance the FortiWebs in standalone mode and use AWS Virtual Private Cloud (VPC) Peering to load balance the internal Web servers.

Refer to the exhibit.

An organization has a FortiGate cluster that is connected to two independent ISPs. You must configure the FortiGate failover for a single ISP failure to occur without disruption.

Referring to the exhibit, which two FortiGate BGP features are enabled to accomplish this task? (Choose two.)

A. EBGP multipath

B. Graceful restart

C. Synchronization

D. BFD

A legacy router has been replaced by a FortiGate device. The FortiGate has inherited the management IP address of the router and now the network administrator needs to remove the router from the FortiSIEM configuration.

Which two statements about this operation are true? (Choose two.)

A. FortiSIEM will move the router device into the Decommission folder.

B. The router will be completely deleted from the FortiSIEM database.

C. By default, FortiSIEM can only parser event logs for FortiGate devices.

D. FortiSIEM will discover a new device for the FortiGate with the same IP.

You have configured an HA cluster with two FortiGate devices. You want to make sure that you are able to manage the individual cluster members directly using port3.

Referring to the configuration shown, in which two ways can you accomplish this task? (Choose two.)

A. Create a management VDOM and disable the HA synchronization for this VDOM, assign port3 to this VDOM, then configure specific IPs for port3 on both cluster members.

B. Configure port3 to be a dedicated HA management interface; then configure specific IPs for port3 on both cluster members.

C. Allow administrative access in the HA heartbeat interfaces.

D. Disable the sync feature on port3; then configure specific IPs for port3 on both cluster members.