Online Access Free NSE8_812 Practice Test

Review the following FortiGate-6000 configuration excerpt:

Based on the configuration, which statement is correct regarding SNAT source port partitioning behavior?

• A.It is the default SNAT configuration and preserves active sessions when an FPC or FPM goes down.
• B.It equally distributes SNAT source ports across chassis slots.
• C.It statically distributes SNAT source ports to operating FPCs or FPMs
• D.It dynamically distributes SNAT source ports to operating FPCs or FPMs.

An administrator has configured a FortiGate device to authenticate SSL VPN users using digital certificates.
A FortiAuthenticator is the certificate authority (CA) and the OCSP server.
Part of the FortiGate configuration is shown below:

Based on this configuration, which authentication scenario will FortiGate deny?

• A.FortiAuthenticator responds to an OCSP request that the user certificate authority is untrusted.
• B.FortiAuthenticator responds to an OCSP request that the user certificate status is unknown.
• C.The user certificate does not contain the OCSP URL.

A remote worker requests access to an SSH server inside the network. You deployed a ZTNA Rule to their FortiClient. You need to follow the security requirements to inspect this traffic.
Which two statements are true regarding the requirements? (Choose two.)

• A.FortiGate can perform SSH access proxy host-key validation.
• B.SSH traffic is tunneled between the client and the access proxy over HTTPS
• C.You need to configure a FortiClient SSL-VPN tunnel to inspect the SSH traffic.
• D.Traffic is discarded as ZTNA does not support SSH connection rules

Refer to the exhibit showing the history logs from a FortiMail device.

Which FortiMail email security feature can an administrator enable to treat these emails as spam?

• A.Sender domain validation in a session profile
• B.DKIM validation in a session profile
• C.Impersonation analysis in an antispam profile
• D.Soft fail SPF validation in an antispam profile

Refer to the exhibits.

The exhibits show a diagram of a requested topology and the base IPsec configuration.
A customer asks you to configure ADVPN via two internet underlays. The requirement is that you use one interface with a single IP address on DC FortiGate.
In this scenario, which feature should be implemented to achieve this requirement?

• A.Change advpn2 to IKEv1
• B.Use local-id
• C.Use network-overlay id
• D.Use peer-id