Get Instant Access of 100% REAL NSE8_813 DUMP Pass Your Exam Easily [Q43-Q57]

Rate this post

Get Instant Access of 100% REAL NSE8_813 DUMP Pass Your Exam Easily

NSE8_813 Free Exam Questions with Quality Guaranteed

Fortinet NSE8_813 Exam Syllabus Topics:

Section	Objectives
Fortinet Product Integration	– Multi-product deployment scenarios 1. FortiGate advanced configuration 2. Integration with FortiManager / FortiAnalyzer 3. Secure access and VPN solutions
Security Operations and Troubleshooting	– Incident analysis and troubleshooting 1. Log analysis and interpretation 2. Traffic flow troubleshooting
Security Solutions Validation	– End-to-end solution validation 1. Policy enforcement testing 2. Configuration verification
Advanced Enterprise Network Security Design	– Secure network architecture design with Fortinet solutions 1. High availability and redundancy design 2. Large-scale enterprise segmentation

Q43. A customer wants to use the FortiAuthenticator REST API to retrieve an SSO group called SalesGroup. The following API call is being made with the ‘curl’ utility:

Which statement correctly describes the expected behavior of the FortiAuthenticator REST API?

Only users with the “Full permission” role can access the REST API.

If it is lost, the current REST API web service access key can be retrieved from the CLI with a diagnose

The API call will fail because you cannot use POSTwith a specific ID.

This API call will fail because it requires API version 2.

Q44. Refer to the exhibit.

An administrator wants to implement a multi-chassis link aggregation (MCLAG) solution using two FortiSwitch 448D devices and one FortiGate 3700D. As described in the network topology shown in the exhibit, two links are already connected from the FortiGate to each FortiSwitch.
What is required to implement this solution? (Choose two.)

Replace the FortiGate as this one does not have an ISF.

Create two separate link aggregated (LAG) interfaces on the FortiGate side for each FortiSwitch.

Add set fortilink-split-interface disable on the FortiLink interface.

An ICL link between both FortiSwitch devices needs to be added.

Q45. A customer is planning on moving their secondary data center to a cloud-based IaaS. They want to place all the Oracle-based systems on Oracle Cloud, while the other systems will be on Microsoft Azure with ExpressRoute service to their main data center.
They have about 200 branches with two internet services as their only WAN connections. As a security consultant you are asked to design an architecture using Fortinet products with security, redundancy, and performance as a priority.
Which two design options are true based on these requirements? (Choose two.)

Systems running on Azure will need to go through the main data center to access the services on Oracle Cloud.

Use FortiGate VM for IPSEC over ExpressRoute, as traffic is not encrypted by Azure.

Branch FortiGate devices must be configured as VPN clients for the branches’ internal network to be able to access Oracle services without using public IPs.

Two ExpressRoute services to the main data center are required to implement SD-WAN between a FortiGate VM in Azure and a FortiGate device at the data center edge.

Q46. Refer to the exhibit.

A VPN IPsec is connecting the headquarters office (HQ) with a branch office (BO). OSPF is used to redistribute routes between the offices. After deployment, a server with IP address 10.10.10.35 located on the DMZ network of the BO FortiGate, was reported unreachable from hosts located on the LAN network of the same FortiGate.
Referring to the exhibit, which statement is true?

The ICMP packets are being blocked by an implicit deny policy.

A directly connected subnet is being partially superseded by an OSPF redistributed subnet.

Enabling NAT on the VPN firewall policy will solve the problem.

The incoming access list should have an accept action instead of a deny action to solve the problem.

Q47. Virtual Domains (VDOMs) allow a FortiGate administrator to do what?

Group two or more FortiGate units to form a single virtual device.

Split a physical FortiGate unit into multiple virtual devices.

Create multiple VLANs in a single physical interface,

Group multiple physical interfaces to form a single virtual interface.

Q48. Refer to the exhibit.

A company has two data centers (DC) connected using a Layer 3 network. Servers in farm A need to connect to servers in farm B as though they were all in the same Layer 2 segment.
Referring to the exhibit, what is configured on the FortiGate devices on each DC to allow this connectivity?

Create an IPsec tunnel with VXLAN encapsulation.

Create an IPsec tunnel with VLAN encapsulation.

Create an IPsec tunnel with transport-mode encapsulation.

Create an IPsec tunnel with tunnel-mode encapsulation.

Q49. An administrator has configured a FortiGate device to authenticate SSL VPN users using dogotal certificates. A FortiAuthenticator is the certificate authority (CA) and the Online Certificate Status Protocol (OCSP) server.
Part of the FortiGate configuration is shown below:

Based on this configuration, which two statements are true? (Choose two.)

OCSP checks will always go to the configured FortiAuthenticator

The OCSP check of the certificate can be combined with a certificate revocation list

OCSP certificate responses are never cached by the FortiGate

If the OCSP server is unreachable, authentication will succeed if the certificate matches the CA

Q50. Refer to the exhibit.

A customer is trying to setup a Playbook automation using a FortiAnalyzer, FortiWeb and FortiGate. The intention is to have the FortiGate quarantine any source of SQL Injection detected by the FortiWeb.
They got the automation stitch to trigger on the FortiGate when simulating an attack to their website, but the quarantine object was created with the IP 0.0.0.0.
Referring to the configuration and logs in the exhibits, which two statements are true? (Choose two.)

The Group By option in the handler should be different to src, so src can be used on the Playbook configuration.

FortiSOC Playbooks combining FortiWeb and FortiGate are not supported.

To diagnose this issue, you need to use the command diagnose test application oftpd 22.

The FortiAnalyzer ADOM Type must be Fabric.

To fix the issue the parameter for script on the Playbook configuration should be epip.

Q51. An HA topology is using the following configuration:

Based on this configuration, how long will it take for a failover to be detected by the secondary cluster member?

600ms

200ms

300ms

100ms

Q52. You are asked to implement a wireless network for a conference center and need to provision a high number of access points to support a large number of wireless client connections. Which statement describes a valid solution for this requirement?

Use a captive portal for guest access.
Use both 2.4 GHz and 5 GHz bands.
Enable frequency and access point hand-off.
Use more channels, thereby supporting more clients.

Use an open wireless network with no portal.
Use both 2.4 GHz and 5 GHz bands.
Use 802.11ac capable access points and configure channel bonding to support greater throughput for wireless clients.

Use a pre-shared key only for wireless client security.
Use the 5 GHz band only for greater security.
Use 802.11ac capable access points and configure channel bonding to support greater throughput for wireless clients.

Use a captive portal for guest access.
Use both the 2.4 GHz and 5 GHz bands, and configure frequency steering.
Configure rogue access point detection in order to automatically control the transmit power of each AP.

Q53. Refer to the exhibit.

Referring to the exhibit, what will happen if FortiSandbox categorizes an e-mail attachment submitted by FortiMail as a high risk?

The high-risk file will be discarded by attachment analysis.

The high-risk file will go to the system quarantine.

The high-risk file will be received by the recipient.

The high-risk file will be discarded by malware/virus outbreak protection.

Q54. A customer with a FortiDDoS 200F protecting their fibre optic internet connection from incoming traffic sees that all the traffic was dropped by the device even though they were not under a DoS attack. The traffic flow was restored after it was rebooted using the GUI.
Which two options will prevent this situation in the future? (Choose two.)

Change the Adaptive Mode.

Create an HA setup with a second FortiDDoS 200F.

Move the internet connection from the SFP interfaces to the LC interfaces.

Replace with a FortiDDoS 1500F.

Q55. You have configured a Site-to-Site IPsec VPN tunnel between a FortiGate and a third-party device but notice that one of the error counters on the tunnel interface keeps increasing.

Which two configuration options can resolve this problem? (Choose two.)

Enable Forward Error Correction (FEC) on the VPN interface for egress traffic.

Enable DF-bit honoring in the global settings.

Adjust the MTU of the physical interface to which the IPsec tunnel is bound.

Adjust the MTU of the IPsec interface.

Q56. A FortiGate is used as a VPN hub for a number of remote spoke VPN units (Group A) spokes using a phase 1 main mode dial-up tunnel and pre-shared keys. You are asked to establish VPN connectivity for a newly acquired organization’s sites for which new devices will be provisioned Group B spokes.
Both existing Group A and new Group B spoke units are dynamically addressed through a single public IP Address on the hub. You are asked to ensure that spokes from Group B have different access permissions than the existing VPN spokes units Group A.
Which two solutions meet the requirements for the new spoke group? (Choose two.)

Implement a new phase 1 dial-up main mode tunnel with a different pre-shared key than the Group A spokes.

Implement a new phase 1 dial-up main mode tunnel with certificate authentication.

Implement a new phase 1 dial-up main mode tunnel with pre-shared keys and XAuth.

Implement separate phase 1 dial-up aggressive mode tunnels with a distinct peer ID.

Q57. Refer to the exhibit, which shows a Branch1 configuration and routing table.

In the SD-WAN implicit rule, you do not want the traffic load balance for the overlay interface when all members are available.
In this scenario, which configuration change will meet this requirement?