Fortinet NSE8 Exam Questions 2021

NEW QUESTION 1

Given the following error message:

FortiManager fails to import policy ID 1. What is the problem?

• A. FortiManager already has Address LAN which has interface mapping set to “internal” in its database, it is contradicting with the STUDENT-2 FortiGate device which has address LAN mapped to “any”.
• B. FortiManager already has address LAN which has interface mapping set to “any” in its database; this conflicts with the STUDENT-2 FortiGate device which has address “LAN”mapped to “internal”.
• C. Policy ID 1 for this managed FortiGate device already exists on the FortiManager policy package named STUDENT-2.
• D. Policy ID 1 does not have interface mapping on FortiManager.

Answer: D

Explanation: References: http://kb.fortinet.com/kb/documentLink.do?externalID=FD38544

NEW QUESTION 2
Which command syntax would you use to configure the serial number of a FortiGate as its host name?

• A.
• B.
• C.
• D.

Answer: AB

Explanation: References:
http://defadhil.blogspot.in/2014/04/how-to- protect-fortigate- from.html

NEW QUESTION 3
Which three configuration scenarios will result in an IPsec negotiation failure between two FortiGate devices? (Choose three.)

• A. mismatched phase 2 selectors
• B. mismatched Anti-Replay configuration
• C. mismatched Perfect Forward Secrecy
• D. failed Dead Peer Detection negotiation
• E. mismatched IKE version

Answer: ACE

Explanation: In IPsec negotiations, Perfect Forward Secrecy (PFS) ensures that each new cryptographic key is unrelated to any previous key. Either enable or disable PFS on both the tunnel peers; otherwise, the LAN-to-LAN (L2L) IPsec tunnel is not established

NEW QUESTION 4
Which command detects where a routing path is broken?

• A. exec traceroute <destination>
• B. exec route ping <destination>
• C. diag route null
• D. diag debug route <destination>

Answer: A

NEW QUESTION 5
You are managing a FortiAnalyzer appliance. After an upgrade, you notice that the unit no longer displays historical logs, reports do not produce any data, and FortiView summary views are empty. However, you notice that the unit is receiving logs on the dashboard widgets.
Which step resolves this problem?

• A. Execute the CLI command exec sql-local rebuild-db.
• B. Execute the CLI command diag sql remove hcache.
• C. Execute the CLI command exec sql-local reinsert-logs.
• D. Restore the unit settings from a previous backup.

Answer: A

NEW QUESTION 6
How would you apply security to the network shown in the exhibit?

• A. Replace RW1 with a ruggedized FortiGate and RW2 with a normal FortiGat
• B. Enable industrial category on the application contro
• C. Place a FortiGate to secure Web server
• D. Configure IPsec to secure sensors dat
• E. Place a ruggedized FortiAP to provide Wi-Fi to the sensors.
• F. Replace RW1 with a normal FortiGate and RW2 with a ruggedized FortiGat
• G. Enable industrial category on the application contro
• H. Place a FortiGate to secure Web server
• I. Configure IPsec to secure sensors dat
• J. Place a FortiAP to provide Wi-Fi to the sensors.
• K. Replace RW1 with a normal FortiGate and RW2 with a ruggedized FortiGat
• L. Enable industrial category on the Web filte
• M. Place a FortiWeb to secure Web server
• N. Configure IPsec to secure sensors dat
• O. Place a ruggedized FortiAP to provide Wi-Fi to the sensors.
• P. Replace RW1 with a normal FortiGate and RW2 with a ruggedized FortiGat
• Q. Enable industrial category on the application contro
• R. Place a FortiWeb to secure Web server
• S. Configure IPsec to secure sensors dat
• T. Place a ruggedized FortiAP to provide Wi-Fi to the sensors.

Answer: D

NEW QUESTION 7
Which three statements about throughput on a wireless network are true? (Choose three.)

• A. A wireless device labelled as 300 Mbps should be expected to provide a throughput of 300Mbps.
• B. Be careful to ensure the capabilities of the wireless clients match those of the access points, in order to achieve higher throughput.
• C. Reducing the duty cycles of the wireless media by generating fewer beacons may improve throughput.
• D. Because of the higher level of RF noise that is typical in the 2.4 GHz ISM band, throughput of 2.4 GHz devices will typically be less than 5 GHz devices.
• E. Because of the full-duplex nature of the medium and the minimal overhead generated by CSMA/CA, the actual aggregate throughput is typically close to the data rate.

Answer: BCD

Explanation: References:
http://www.tp-link.in/faq-499.html

NEW QUESTION 8
There is an interface-mode IPsec tunnel configured between FortiGate1 and FortiGate2. You want to run OSPF over the IPsec tunnel. On both FortiGates. the IPsec tunnel is based on physical interface port1. Port1 has the default MTU setting on both FortiGate units.
Which statement is true about this scenario?

• A. A multicast firewall policy must be added on FortiGate1 and FortiGate2 to allow protocol 89.
• B. The MTU must be set manually in the OSPF interface configuration.
• C. The MTU must be set manually on the IPsec interface.
• D. An IP address must be assigned to the IPsec interface on FortiGate1 and FortiGate2.

Answer: B

Explanation: If MTU doesn’t match then the neighbour ship gets stuck in exchange state.

NEW QUESTION 9
Your colleague has enabled virtual clustering to load balance traffic between the cluster units. You notice that all traffic is currently directed to a single FortiGate unit. Your colleague has applied the configuration shown in the exhibit.

Which step would you perform to load balance traffic within the virtual cluster?

• A. Issue the diagnose sys ha reset-uptime command on the unit that is currently processing traffic to enable load balancing.
• B. Add an additional virtual cluster high-availability link to enable cluster load balancing.
• C. Input Virtual Cluster domain 1 and Virtual Cluster domain 2 device priorities for each cluster unit.
• D. Use the set override enable command on both units to allow the secondary unit to load balance traffic.

Answer: C

Explanation: References:

NEW QUESTION 10
The FortiGate is an IPsec VPN hub. A VPN spoke protecting subnet 192.168.222.0/24 has successfully brought up a tunnel with the FortiGate. This remote network is present in the FortiGate routing table as shown in the exhibit.

Which statement is true?

• A. This subnet was learned during quick-mode negotiation and was dynamically injected into the routing table.
• B. The FortiGate administrator configured this subnet as a locally connected subnet on the “BranchOffice” phase1 interface.
• C. The route in the exhibit is bound to “BranchOffice_0” which is a tunnel other than “BranchOffice”.
• D. The FortiGate administrator configured a static route for 192.168.222.0/24.

Answer: B

NEW QUESTION 11
You are investigating a problem related to FTP active mode. You use a test PC with IP address 10.100.60.5 to connect to the FTP server at 172.16.133.50 and transfer a large file. The FortiGate translates source address (SNAT) in network 10.100.60.0/24 to the IP address 172.16.133.1.
Which two groups of CLI commands allow you to see information related to this FTP connection (Choose two.)

• A.
• B.
• C.
• D.

Answer: AD

Explanation: FTP active on port 21 and passive uses port 20

NEW QUESTION 12
A company wants to protect against Denial of Service attacks and has launched a new project. They want to block the attacks that go above a certain threshold and for some others they are just trying to get a baseline of activity for those types of attacks so they are
letting the traffic pass through without action. Given the following:
- The interface to the Internet is on WAN1.
- There is no requirement to specify which addresses are being protected or protected from.
- The protection is to extend to all services.
- The tcp_syn_flood attacks are to be recorded and blocked.
- The udp_flood attacks are to be recorded but not blocked.
- The tcp_syn_flood attack’s threshold is to be changed from the default to 1000. The exhibit shows the current DoS-policy.

Which policy will implement the project requirements?

• A.
• B.
• C.
• D.

Answer: BD

Explanation: B&D both have same policy which fulfills the above criteria. http://help.fortinet.com/fos50hlp/52data/Content/FortiOS/fortigate-firewall-52/Examples/Example-%20DoS%20Policy.htm

NEW QUESTION 13
Your company uses a cluster of two FortiGate 3600C units in active-passive mode to protect the corporate network. The FortiGate cluster sends its logs to a FortiAnalyzer and you have configured scheduled weekly reports for the Internet bandwidth usage of each corporate VLAN. During a scheduled maintenance window, you make a series of configuration changes. When the next FortiAnalyzer weekly report is generated, you notice that Internet bandwidth usage reported by the FortiAnalyzer is far less than expected.
What is the reason for this discrepancy?

• A. You applied an antivirus profile on some of the policies, and no traffic can be accelerated.
• B. You disabled all security profiles on some of the firewall policies, and the traffic matching those policies is now accelerated.
• C. You enabled HA session-pickup, which is turn disabled session accounting.
• D. You changed from active-passive to active-active, causing the session traffic counters to become inaccurate.

Answer: D

Explanation: Because of Active/Active failover traffic segregate to boxes where it reduces the bandwidth utilization

NEW QUESTION 14
Referring to the command output shown in the exhibit, how many hosts are connected to the FortiGate?

• A. 7
• B. 6
• C. 2
• D. 256

Answer: B

Explanation: References:
http://cookbook.fortinet.com/troubleshooting-fortigate-installation/

NEW QUESTION 15
The dashboard widget indicates that FortiGuard Web Filtering is not reachable. However, AntiVirus, IPS, and Application Control have no problems as shown in the exhibit.

You contacted Fortinet’s customer service and discovered that your FortiGuard Web Filtering contract is still valid for several months.
What are two reasons for this problem? (Choose two.)

• A. You have another security device in front of FortiGate blocking ports 8888 and 53.
• B. FortiGuard Web Filtering is not enabled in any firewall policy.
• C. You did not enable Web Filtering cache under Web Filtering and E-mail Filtering Options.
• D. You have a firewall policy blocking ports 8888 and 53.

Answer: BD

Explanation: If Web filtering shows unreachable then we have to verify, whether web filtering enabled in security policies or not.
Web filtering enabled in a policy but the port 8888 and 53 are not selected, means the policy blocking the ports.
References:

NEW QUESTION 16
You notice that memory usage is high and FortiGate has entered conserve mode. You want FortiGate’s IPS engine to focus only on exploits and attacks that are applicable to your specific network.
Which two steps would you take to reduce RAM usage without weakening security? (Choose two.)

• A. Configure IPS to pass files that are larger than a specific threshold, instead of buffering and scanning them.
• B. Reduce the size of the signature three (filters) that FortiGate must search by disabling scans for applications and OS stacks that do not exist on your network.
• C. Disable application control for protocols that are not used on your network.
• D. Disable IPS for traffic destined for the FortiGate itself.

Answer: BD