100% PASS RATE Fortinet NSE 8 NSE8_813 Certified Exam DUMP with 245 Questions
Updates For the Latest NSE8_813 Free Exam Study Guide!
NEW QUESTION # 84
Which two methods are supported for importing user defined Lookup Table Data into the FortiSIEM? (Choose two.)
- A. Report
- B. FTP
- C. API
- D. SCP
Answer: A,C
Explanation:
FortiSIEM supports two methods for importing user defined Lookup Table Data:
Report: You can import lookup table data from a report. This is the most common method for importing lookup table data.
API: You can also import lookup table data using the FortiSIEM API. This is a more advanced method that allows you to import lookup table data programmatically.
NEW QUESTION # 85
Refer to the exhibits, which show a firewall policy configuration and a network topology.
Configuration
Topology
An administrator has configured an inbound SSL inspection profile on a FortiGate device (FG-1) that is protecting a data center hosting multiple web pages.
Given the scenario shown in the exhibits, which certificate will FortiGate use to handle requests to xyz.com?
- A. FortiGate will use the Fortmet_CA_Untrusted certificate for the untrusted connection
- B. FortiGate will use the first certificate in the server-cert list-the abc.com certificate
- C. FortiGate will fall-back to the default Fortinet_CA_SSL certificate
- D. FortiGate will reject the connection since no certificate is defined
Answer: B
Explanation:
https://docs.fortinet.com/document/fortigate/7.4.1/administration-guide/850344/define-multiple- certificates-in-an-ssl-profile-in-replace-mode If there is no matched server certificate in the list, then the first server certificate in the list is used as a replacement.
NEW QUESTION # 86
You are deploying a FortiExtender (FEX) on a ForiGate-60F. The FEX will be managed by the FortiGate. You anticipate high utilization. The requirement is to minimize the overhead on the device for WAN traffic.
Which action achieves the requirement in this scenario?
- A. Change connectivity between the FortiGate and the FortiExtender to use VLAN Mode
- B. Enable CAPWAP connectivity between the FortiGate and the FortiExtender
- C. Add a VLAN under the FEX-WAN interface on the FortiGate
- D. Add a switch between the FortiGate and FEX.
Answer: A
Explanation:
http://docs.fortinet.com/document/fortiextender/7.0.3/admin-guide-fgt-managed/394272/vlan- mode
http://docs.fortinet.com/document/fortiextender/7.0.3/admin-guide-fgt-managed/618684/vlan- mode-and-performance
NEW QUESTION # 87
Refer to the exhibit.
You have installed a FortiSandbox and configured it in your FortiMail.
Referring to the exhibit, which two statements are correct? (Choose two.)
- A. FortiMail will wait up to 30 minutes to obtain the scan results.
- B. FortiMail will cache the results for 30 minutes
- C. If the FortiSandbox with IP 10.10.10.3 is not available, the e-mail will be checked by the FortiCloud Sandbox.
- D. If FortiMail is not able to obtain the results from the FortiGuard queries, URIs will not be checked by the FortiSandbox.
Answer: A,D
NEW QUESTION # 88
Refer to the exhibits.
Exhibit A
Exhibit B
Exhibit C
A customer is trying to set up a VPN with a FortiGate, but they do not have a backup of the configuration. Output during a troubleshooting session is shown in the exhibits A and B and a baseline VPN configuration is shown in Exhibit C.
Referring to the exhibits, which configuration will restore VPN connectivity?
- A.
- B.
- C.
- D.
Answer: C
Explanation:
NPU_flag 03 both ingress and egress will be offloaded.
NEW QUESTION # 89
Refer to the exhibit.
You created an aggregate interface between a FortiGate and a switch consisting of two 1 Gbps links as shown in the exhibit. However, the maximum bandwidth never exceeds 1 Gbps and employees are reporting that the network is slow. After troubleshooting, you notice that only one member interface is being used. The configuration for the aggregate interface is shown in the exhibit.
In this scenario, which command will solve this problem?
- A.
- B.
- C.
- D.
Answer: C
NEW QUESTION # 90
What is the benefit of using FortiGate NAC LAN Segments?
- A. It allows for assignment of dynamic address objects matching NAC policy
- B. It provides support for IGMP snooping between hosts within the same VLAN
- C. It provides support for multiple DHCP servers within the same VLAN
- D. It provides physical isolation without changing the IP address of hosts
Answer: D
Explanation:
FortiGate NAC LAN Segments are a feature that allows users to assign different VLANs to different LAN segments without changing the IP address of hosts or bouncing the switch port.
This provides physical isolation while maintaining firewall sessions and avoiding DHCP issues.
One benefit of using FortiGate NAC LAN Segments is that it allows for assignment of dynamic address objects matching NAC policy. This means that users can create firewall policies based on dynamic address objects that match the NAC policy criteria, such as device type, OS type, MAC address, etc. This simplifies firewall policy management and enhances security by applying different security profiles to different types of devices.
NEW QUESTION # 91
On a FortiGate configured in Transparent mode, which configuration option allows you to control Multicast traffic passing through the device?
- A.
- B.
- C.
- D.
Answer: B
Explanation:
To disable multicast traffic from passing through the FortiGate without a policy check in transparent mode:
config system settings
set multicast-skip-policy disable
end
NEW QUESTION # 92
The output shown on the exhibit from FortiManager is displayed during an import if the device configuration .
Which statement describes the correct action taken for these duplicate objects?
- A. The import fails because of the duplicate entries detected which exist in the ADOM database.
- B. FortiManager does not import these duplicate entries into the ADOM database because they already exist in the ADOM database.
- C. FortiManager creates indexed duplicate entries for these objects in the ADOM database.
- D. Forti Manager installs these duplicate objects to the managed device from the ADOM database.
Answer: B
Explanation:
The object page will search for dependencies, and reports any conflicts it detects. If conflicts are detected, you must decide whether to use the FortiGate value or the FortiManager value. If there are conflicts, you can select View Details to view details of each individual conflict, or you can download an HTML conflict file to view all the details about the conflicts. Duplicates will not be imported.
NEW QUESTION # 93
Referring to the exhibit, you want to know if aggregating port7 and port22 will work.
Which statement is correct?
- A. Yes, LACP is supported on ports that are linked together with integrated Switch Fabric.
- B. No, LACP is only supported on ports connected to the same NP6.
- C. No, LACP is not supported on NP6 platforms.
- D. Yes, LACP is supported on all ports regardless if they are connected to the same NP6.
Answer: A
Explanation:
http://help.fortinet.com/fos50hlp/52data/Content/FortiOS/fortigate-hardware-acceleration-
52/NP6.htm?Highlight=lag
NEW QUESTION # 94
Refer to the configuration snippet:
What will happen if you set the cp-accel-mode parameter to advanced? (Choose two.)
- A. The CP ASIC will start processing all IPS traffic.
- B. Enhanced IPSA will be enabled.
- C. The flow-based IPS signature correlation will be offloaded.
- D. nTurbo will be enabled.
Answer: B,C
Explanation:
Enhanced IPSA:
Setting the cp-accel-modeparameter to advanced enables enhanced IPS acceleration features that use the Content Processor (CP) to process IPS traffic more efficiently, including advanced signature matching.
Flow-based IPS Signature Correlation Offloading:
When cp-accel-modeis set to advanced, flow-based IPS traffic is offloaded to the CP for signature correlation, freeing up the CPU and improving performance.
NEW QUESTION # 95
Which VPN protocol is supported by FortiGate units?
- A. DMVPN
- B. E-LAN
- C. OpenVPN
- D. PPTP
Answer: D
NEW QUESTION # 96
The wireless controller diagnostic output is shown on the exhibit.
Which three statements are true? (Choose three.)
- A. Firewall policies using device types are blocking Android devices.
- B. An access control list applied to the VAP interface blocks Android devices.
- C. This is a CAPWAP control channel diagnostic command.
- D. There are no wireless clients connected to the guest wireless network.
- E. The "src-vis" process is active on the staff wireless network VAP interface.
Answer: A,C,D
Explanation:
http://docs.fortinet.com/uploaded/files/1083/fortigate-managing-devices-50.pdf
NEW QUESTION # 97
Refer to the CLI output:
Given the information shown in the output, which two statements are correct? (Choose two.)
- A. An IP address that was previously used by an attacker will always be blocked
- B. Reputation from blacklisted IP addresses from DHCP or PPPoE pools can be restored
- C. Geographical IP policies are enabled and evaluated after local techniques
- D. The IP Reputation feature has been manually updated
- E. Attackers can be blocked before they target the servers behind the FortiWeb
Answer: B,E
Explanation:
The CLI output shown in the exhibit indicates that FortiWeb has enabled IP Reputation feature with local techniques enabled and geographical IP policies enabled after local techniques (set geoip-policy-order after-local). IP Reputation feature is a feature that allows FortiWeb to block or allow traffic based on the reputation score of IP addresses, which reflects their past malicious activities or behaviors. Local techniques are methods that FortiWeb uses to dynamically update its own blacklist based on its own detection of attacks or violations from IP addresses (such as signature matches, rate limiting, etc.). Geographical IP policies are rules that FortiWeb uses to block or allow traffic based on the geographical location of IP addresses (such as country, region, city, etc.). Therefore, based on the output, one correct statement is that attackers can be blocked before they target the servers behind the FortiWeb. This is because FortiWeb can use IP Reputation feature to block traffic from IP addresses that have a low reputation score or belong to a blacklisted location, which prevents them from reaching the servers and launching attacks.
Another correct statement is that reputation from blacklisted IP addresses from DHCP or PPPoE pools can be restored. This is because FortiWeb can use local techniques to remove IP addresses from its own blacklist if they stop sending malicious traffic for a certain period of time (set local-techniques-expire-time), which allows them to regain their reputation and access the servers. This is useful for IP addresses that are dynamically assigned by DHCP or PPPoE and may change frequently.
Fortinet compiles a reputation for each public IP address. Clients will have poor reputations if they have been participating in attacks, willingly or otherwise. Because blacklisting innocent clients is equally undesirable, Fortinet also restores the reputations of clients that improve their behavior.
This is crucial when an infected computer is cleaned, or in DHCP or PPPoE pools where an innocent client receives an IP address that was previously leased by an attacker.
NEW QUESTION # 98
How would you apply security to the network shown on the exhibit?
- A. Replace RW1 with a ruggedized FortiGate and RW2 with a normal FortiGate.
Enable industrial category on the application control Place a FortiGate to secure Web servers.
Configure IPsec to secure sensors data.
Place a ruggedized FortiAP to provide Wi-Fi to the sensors. - B. Replace RW1 with a normal FortiGate and RW2 with a ruggedized FortiGate.
Enable industrial category on the application control Place a FortiWeb to secure Web servers.
Configure IPsec to secure sensors data.
Place a ruggedized FortiAP to provide Wi-Fi to the sensors. - C. Replace RW1 with a normal FortiGate and RW2 with a ruggedized FortiGate.
Enable industrial category on the Web filter.
Place a FortiWeb to secure Web servers.
Configure IPsec to secure sensors data.
Place a ruggedized FortiAP to provide Wi-Fi to the sensors. - D. Replace RW1 with a normal FortiGate and RW2 with a ruggedized FortiGate.
Enable industrial category on the application control Place a FortiGate to secure Web servers.
Configure IPsec to secure sensors data.
Place a FortiAP to provide Wi-Fi to the sensors.
Answer: A
NEW QUESTION # 99
You must configure an environment with dual-homed servers connected to a pair of FortiSwitch units using an MCLAG.
Multicast traffic is expected in this environment, and should ensure unnecessary traffic is pruned from links that do not have a multicast listener.
In which two ways must you configure the igmps-flood-traffic and igmps-flood-report settings?
(Choose two.)
- A. disable on the ISL and FortiLink trunks
- B. enable on the ISL and FortiLink trunks
- C. disable on ICL trunks
- D. enable on ICL trunks
Answer: A,D
NEW QUESTION # 100
Your colleague has enabled virtual clustering to load balance traffic between the cluster units.
You notice that all traffic is currently directed to a single FortiGate unit. Your colleague has applied the configuration shown in the exhibit.
Which step would you perform to load balance traffic within the virtual cluster?
- A. Issue the diagnose sys ha reset-uptime command on the unit that is currently processing traffic to enable load balancing.
- B. Input Virtual Cluster domain 1 and Virtual Cluster domain 2 device priorities for each cluster unit.
- C. Use the set override enable command on both units to allow the secondary unit to load balance traffic.
- D. Add an additional virtual cluster high-availability link to enable cluster load balancing.
Answer: B
Explanation:
http://docs.fortinet.com/uploaded/files/1088/fortigate-ha-50.pdf
NEW QUESTION # 101
Which three statements about throughput on a wireless network are true? (Choose three.)
- A. Reducing the duty cycles of the wireless media by generating fewer beacons may improve throughput.
- B. Because of the full-duplex nature of the medium and the minimal overhead generated by CSMA/CA, the actual aggregate throughput is typically close to the data rate.
- C. Be careful to ensure the capabilities of the wireless clients match those of the access points, in order to achieve higher throughput.
- D. Because of the higher level of RF noise that is typical in the 2.4 GHz ISM band, throughput of 2.4 GHz devices will typically be less than 5 GHz devices.
- E. A wireless device labelled as 300 Mbps should be expected to provide a throughput of 300Mbps.
Answer: A,D,E
Explanation:
http://www.tp-link.in/faq-499.html
NEW QUESTION # 102
......
Best NSE8_813 Exam Preparation Material with New Dumps Questions https://certblaster.lead2passed.com/Fortinet/NSE8_813-practice-exam-dumps.html
