Fortinet NSE 8 Written Exam (NSE8_811) 認定 NSE8_811 試験問題:

1. A customer wants to enable SYN Rood mitigation in a FortiDDoS device. The FortiDDoS must reply with one SYN/ACK packet per SYN packet ftom a new source IP address. Which SYN packet from a new source IP address.
Which SYN flood mitigation mode must the customer use?

A) SYN/ACK cookie
B) SYN retransmission
C) ACK cookie
D) SYN cookie

2. Refer to the exhibit.

The exhibit shows a full-mesh topology between FortiGate and FortiSwitch devices. To deploy this configuration, two requirements must be met:
* 20 Gbps full duplex connectivity is available between each FortiGate and the FortiSwitch devices
* The FortiGate HA must be in AP mode
Referring to the exhibit, what are two actions that will fulfill the requirements? (Choose two.)

A) Configure the master FortiGate with one LAG and FortiLink split interface disabled on ports connected to cables A and C and make sure the same ports are used for cables B and D on the slave.
B) Configure the master FortiGate with one LAG and FortiLink split interface enabled on ports connected to cables A and C and make sure the same ports are used for cables B and D on the slave.
C) Configure both FortiSwitch devices as peers with ICL over cable E, create one MCLAG on ports connected to cables A and C, and create another MCLAG on ports connected to cables B and D.
D) Configure both FortiSwitch devices as peers with ISL over cable E, create one MCLAG on ports connected to cables A and C, and create another MCLAG on ports connected to cables B and D.

3. You want to access the JSON API on FortiManager to retrieve information on an object.
In this scenario, which two methods will satisfy the requirement? (Choose two.)

A) Make a call with the SoapUl API tool on your workstation.
B) Make a call with the curl utility on your workstation
C) Make a call with the Web browser on your workstation.
D) Download the WSDL file from FortiManager administration GUI.

4. Click the Exhibit button.
Central NAT was configured on a FortiGate firewall. A sniffer shows ICMP packets out to a host on the Internet egresses with the port1 IP address instead of the virtual IP(VIP) that was configured.
Referring to the exhibit, which configuration will ensure that ICMP traffic is also translated?

A) config firewall central-snat-map edit 1 set protocol 1 next end
B) config firewall central-snat-map edit 1 set orig-addr "all" next end
C) config firewall ippool edit "secondry_ip" set arp-intf 'port1' next end
D) config firewall central-snat-map edit 1 unset protocol next end

5. Exhibit

The exhibit shows a topology where a FortiGate is two VDOMS, root and vd-vlasn. The root VDCM provides SSL-VPN access, where the users authenticated by a FortiAuthenticatator. The vd-lan VDOM provids internal access to a Web server. For the remote users to access the internal web server, there are a few requirements, which are shown below.
--At traffic must come from the SSI-VPN
--The vd-lan VDOM only allows authenticated traffic to the Web server.
-- Users must only authenticate once, using the SSL-VPN portal.
-- SSL-VPN uses RADIUS-based authentication.
referring to the exhibit, and the requirement describe above, which two statements are true?
(Choose two.)

A) root sends "RADIUS Accounting Messages" to FortiAuthenticator.
B) vd-lan authentication messages from root using FSSO.
C) vd-lan connects to Fort authenticator as a regular FSSO client.
D) root is configured for FSSO while vd-lan is configuration for RSSO.

質問と回答：