nse8 fortinet - gratis exam · the exhibit shows an ldap server configuration in a fortigate...

http://www.gratisexam.com/

NSE8 fortinet

Number: NSE8Passing Score: 800Time Limit: 120 min



Exam A

QUESTION 1There is an interface-mode IPsec tunnel configured between FortiGate1 and FortiGate2. You want to runOSPF over the IPsec tunnel. On both FortiGates. the IPsec tunnel is based on physical interface port1.Port1 has the default MTU setting on both FortiGate units.Which statement is true about this scenario?

A. A multicast firewall policy must be added on FortiGate1 and FortiGate2 to allow protocol 89.

B. The MTU must be set manually in the OSPF interface configuration.

C. The MTU must be set manually on the IPsec interface.

D. An IP address must be assigned to the IPsec interface on FortiGate1 and FortiGate2.

Correct Answer: BSection: (none)Explanation

Explanation/Reference:If MTU doesn’t match then the neighbour ship gets stuck in exchange state.

QUESTION 2Which three configuration scenarios will result in an IPsec negotiation failure between two FortiGatedevices? (Choose three.)


A. mismatched phase 2 selectors

B. mismatched Anti-Replay configuration

C. mismatched Perfect Forward Secrecy

D. failed Dead Peer Detection negotiation

E. mismatched IKE version

Correct Answer: CSection: (none)Explanation

Explanation/Reference:Explanation:In IPsec negotiations, Perfect Forward Secrecy (PFS) ensures that each new cryptographic key is unrelatedto any previous key. Either enable or disable PFS on both the tunnel peers; otherwise, the LAN-to-LAN(L2L) IPsec tunnel is not established

QUESTION 3Which three statements about throughput on a wireless network are true? (Choose three.)

A. A wireless device labelled as 300 Mbps should be expected to provide a throughput of 300Mbps.

B. Be careful to ensure the capabilities of the wireless clients match those of the access points, in order toachieve higher throughput.

C. Reducing the duty cycles of the wireless media by generating fewer beacons may improve throughput.

D. Because of the higher level of RF noise that is typical in the 2.4 GHz ISM band, throughput of 2.4 GHzdevices will typically be less than 5 GHz devices.

E. Because of the full-duplex nature of the medium and the minimal overhead generated by CSMA/CA, theactual aggregate throughput is typically close to the data rate.

Correct Answer: DSection: (none)


Explanation

Explanation/Reference:References:http://www.tp-link.in/faq-499.html

QUESTION 4An administrator wants to assign static IP addresses to users connecting tunnel-mode SSL VPN. Each SSLVPN user must always get the same unique IP address which is never assigned to any other user.Which solution accomplishes this task?

A. TACACS+ authentication with an attribute-value (AV) pair containing each user’s IP address.

B. RADIUS authentication with each user’s IP address stored in a Vendor Specific Attribute (VSA).

C. LDAP authentication with an LDAP attribute containing each user’s IP address.

D. FSSO authentication with an LDAP attribute containing each user’s IP address.

Correct Answer: DSection: (none)Explanation

Explanation/Reference:

QUESTION 5

The exhibit shows an LDAP server configuration in a FortiGate device. The LDAP user, John Smith, has thefollowing LDAP attributes:

John Smith’s LDAP password is ABC123.Which CLI command should you use to test the LDAP authentication using John Smith’s credentials?

A. diagnose test authserver ldap Lab jsmith ABC123

B. diagnose test authserver ldap-direct Lab jsmith ABC123

C. diagnose test authserver ldap Lab ‘John Smith’ ABC123

D. diagnose test authserver ldap-direct Lab john ABC123

Correct Answer: ASection: (none)Explanation


Explanation/Reference:References:https://forum.fortinet.com/tm.aspx?m=119178

QUESTION 6Your NOC contracts the security team due to a problem with a new application flow. You are instructed todisable hardware acceleration for the policy shown in the exhibit for troubleshooting purposes.

Which command will disable hardware acceleration for the new application policy?

A.

B.

C.

D.

Correct Answer: D


Section: (none)Explanation

Explanation/Reference:References:http://docs.fortinet.com/uploaded/files/1607/fortigate-hardware-accel-50.pdf

QUESTION 7Your company uses a cluster of two FortiGate 3600C units in active-passive mode to protect the corporatenetwork. The FortiGate cluster sends its logs to a FortiAnalyzer and you have configured scheduled weeklyreports for the Internet bandwidth usage of each corporate VLAN. During a scheduled maintenance window,you make a series of configuration changes. When the next FortiAnalyzer weekly report is generated, younotice that Internet bandwidth usage reported by the FortiAnalyzer is far less than expected.What is the reason for this discrepancy?

A. You applied an antivirus profile on some of the policies, and no traffic can be accelerated.

B. You disabled all security profiles on some of the firewall policies, and the traffic matching those policies isnow accelerated.

C. You enabled HA session-pickup, which is turn disabled session accounting.

D. You changed from active-passive to active-active, causing the session traffic counters to becomeinaccurate.


Explanation/Reference:Explanation:Because of Active/Active failover traffic segregate to boxes where it reduces the bandwidth utilization

QUESTION 8You notice that memory usage is high and FortiGate has entered conserve mode. You want FortiGate’s IPSengine to focus only on exploits and attacks that are applicable to your specific network.Which two steps would you take to reduce RAM usage without weakening security? (Choose two.)


A. Configure IPS to pass files that are larger than a specific threshold, instead of buffering and scanningthem.

B. Reduce the size of the signature three (filters) that FortiGate must search by disabling scans forapplications and OS stacks that do not exist on your network.

C. Disable application control for protocols that are not used on your network.

D. Disable IPS for traffic destined for the FortiGate itself.

Correct Answer: BDSection: (none)Explanation


QUESTION 9A café offers free Wi-Fi. Customers’ portable electronic devices often do not have antivirus softwareinstalled and may be hosting worms without their knowledge. You must protect all customers from any othercustomers’ infected devices that join the same SSID.Which step meets the requirement?

A. Enable deep SSH inspection with antivirus and IPS.


B. Use a captive portal to redirect unsecured connections such as HTTP and SMTP to their securedequivalents, preventing worms on infected clients from tampering with other customer traffic.

C. Use WPA2 encryption and configure a policy on FortiGate to block all traffic between clients.

D. Use WPA2 encryption, and enable “Block Intra-SSID Traffic”.



QUESTION 10You verified that application control is working from previous configured categories. You just added Skypeon blocked signatures. However, after applying the profile to your firewall policy, clients running Skype canstill connect and use the application.What are two causes of this problem? (Choose two.)

A. The application control database is not updated.

B. SSL inspection is not enabled.

C. A client on the network was already connected to the Skype network and serves as relay prior toconfiguration changes to block Skype

D. The FakeSkype.botnet signature is included on your application control sensor.

Correct Answer: ABSection: (none)Explanation


QUESTION 11Given the following FortiOS 5.2 commands:

Which vulnerability is being addresses when managing FortiGate through an encrypted managementprotocol?

A. Remote Exploit Vulnerability in Bash (ShellShock)

B. Information Disclosure Vulnerability in OpenSSL (Heartbleed)

C. SSL v3 POODLE Vulnerability

D. SSL/TLS MITM vulnerability (CVE-2014-0224)


Explanation/Reference:References:http://kb.fortinet.com/kb/documentLink.do?externalID=FD36913

QUESTION 12


Given the following error message:

FortiManager fails to import policy ID 1.What is the problem?

A. FortiManager already has Address LAN which has interface mapping set to “internal” in its database, it iscontradicting with the STUDENT-2 FortiGate device which has address LAN mapped to “any”.

B. FortiManager already has address LAN which has interface mapping set to “any” in its database; thisconflicts with the STUDENT-2 FortiGate device which has address “LAN” mapped to “internal”.

C. Policy ID 1 for this managed FortiGate device already exists on the FortiManager policy package namedSTUDENT-2.

D. Policy ID 1 does not have interface mapping on FortiManager.


Explanation/Reference:References:http://kb.fortinet.com/kb/documentLink.do?externalID=FD38544

QUESTION 13You are an administrator of FortiGate devices that use FortiManager for central management. You need toadd a policy on an ADOM, but upon selecting the ADOM drop-down list, you notice that the ADOM is inlocked state. Workflow mode is enabled on your FortiManager to define approval or notification workflowwhen creating and installing policy changes.What caused this problem?

A. Another administrator has locked the ADOM and is currently working on it.

B. There is pending approval waiting from a previous modification.

C. You need to use set workspace-mode workflow on the CLI.

D. You have read-only permission on Workflow Approve in the administrator profile.



Explanation/Reference:http://docs.fortinet.com/uploaded/files/2250/FortiManager-5.2.1-Administration-Guide.pdf

QUESTION 14

The output shown in the exhibit from FortiManager is displayed during an import of the device configuration.Which statement describes the correct action taken for these duplicate objects?

A. The import fails because of the duplicate entries detected which exist in the ADOM database.

B. FortiManager installs these duplicate objects to the managed device from the ADOM database.

C. FortiManager does not import these duplicate entries into the ADOM database because they alreadyexist in the ADOM database.

D. FortiManager creates indexed duplicate entries for these objects in the ADOM database.


Explanation/Reference:References:http://docs.fortinet.com/uploaded/files/2905/FortiManager-5.4.0-Administration-Guide.pdf

QUESTION 15Your FortiGate has multiple CPUs. You want to verify the load for each CPU.Which two commands will accomplish this task? (Choose two.)

A. get system performance status

B. diag system mpstat

C. diag system cpu stat

D. diag system top

Correct Answer: ADSection: (none)Explanation

Explanation/Reference:References:http://kb.fortinet.com/kb/documentLink.do?externalID=13825

QUESTION 16


Referring to the configuration shown in the exhibit, which three statements are true? (Choose three.)

A. Traffic logging is disabled in policy 96.

B. TCP handshake is completed and no FIN/RST has been forwarded.

C. No packet has hit this session in the last five minutes.

D. No QoS is applied to this traffic.

E. The traffic goes through a VIP applied to policy 96.


Explanation/Reference:References:http://kb.fortinet.com/kb/viewContent.do?externalId=FD30042

QUESTION 17You are investigating a problem related to FTP active mode. You use a test PC with IP address 10.100.60.5to connect to the FTP server at 172.16.133.50 and transfer a large file. The FortiGate translates sourceaddress (SNAT) in network 10.100.60.0/24 to the IP address 172.16.133.1.Which two groups of CLI commands allow you to see information related to this FTP connection (Choosetwo.)



A.

B.

C.

D.


Explanation/Reference:FTP active on port 21 and passive uses port 20

QUESTION 18


Referring to the exhibit, you want to know if aggregating port7 and port22 will work.Which statement is correct?

A. Yes, LACP is supported on all ports regardless if they are connected to the same NP6.

B. No, LACP is not supported on NP6 platforms.

C. No, LACP is only supported on ports connected to the same NP6.

D. Yes, LACP is supported on ports that are linked together with integrated Switch Fabric.


Explanation/Reference:References:http://help.fortinet.com/fos50hlp/54/Content/FortiOS/fortigate-hardware-acceleration-52/NP6.htm

QUESTION 19


Referring to the command output shown in the exhibit, how many hosts are connected to the FortiGate?

A. 7

B. 6

C. 2

D. 256


Explanation/Reference:References:http://cookbook.fortinet.com/troubleshooting-fortigate-installation/

QUESTION 20


The wireless controller diagnostic output is shown in the exhibit.Which three statements are true? (Choose three.)

A. Firewall policies using device types are blocking Android devices.

B. An access control list applied to the VAP interface blocks Android devices.

C. This is a CAPWAP control channel diagnostic command.

D. There are no wireless clients connected to the guest wireless network.

E. The “src-vis” process is active on the staff wireless network VAP interface.


Explanation/Reference:References:http://docs.fortinet.com/uploaded/files/1083/fortigate-managing-devices-50.pdf

QUESTION 21


You are installing a new FortiAP as shown in the exhibit, however, the FortiAP cannot discover theFortiGate. The FortiAP obtained an IP from the DHCP server and is reachable.Which two configurations will resolve the problem? (Choose two.)

A.

B.

C.


D.


Explanation/Reference:References:https://forum.fortinet.com/tm.aspx?m=112739

QUESTION 22You are asked to implement a wireless network for a conference center and need to provision a highnumber of access points to support a large number of wireless client connections.Which statement describes a valid solution for this requirement?

A. Use a captive portal for guest access. Use both 2.4 GHz and 5 GHz bands. Enable frequency andaccess point hand-off. Use more channels, thereby supporting more clients.

B. Use an open wireless network with no portal. Use both 2.4 GHz and 5 GHz bands. Use 802.11accapable access points and configure channel bonding to support greater throughput for wireless clients.

C. Use a pre-shared key only for wireless client security. Use the 5 GHz band only for greater security. Use802.11ac capable access points and configure channel bonding to support greater throughput forwireless clients.

D. Use a captive portal for guest access. Use both the 2.4 GHz and 5 GHz bands, and configure frequencysteering. Configure rogue access point detection in order to automatically control the transmit power ofeach AP.



QUESTION 23The FortiGate is used as an IPsec gateway at a branch office. Two tunnels, tunA and tunB, are establishedbetween this FortiGate and the headquarters’ IPsec gateway. The branch office’s subnet is 10.1.1.0/24. Theheadquarters’ subnet is 10.2.2.0/24. The desired usage for tunA and tunB has been defined as follows:- sessions initiated from 10.1.1.0/24 to 10.2.2.0/24 must be routed out over tunA when tunA is up- sessions initiated from 10.1.1.0/24 to 10.2.2.0/24 have to be routed out over tunB when tunA is down- sessions initiated from 10.2.2.0/24 can ingress either on tunA or on tunBWhich static routing configuration meets the requirements?


A.

B.

C.

D.




QUESTION 24

You must establish a BGP peering with a service provider. The provider has supplied you with BGP peeringparameters and you performed the basic configuration shown in the exhibit on your FortiGate unit. Younotice that your peering session is not coming up.Which three missing configuration statements are needed to make this configuration functional? (Choosethree.)

A.

B.

C.


D.

E.

Correct Answer: CDESection: (none)Explanation


QUESTION 25You are asked to design a secure solution using Fortinet products for a company. The company recentlyhas Web servers that were exploited and defaced. The customer has also experienced Denial or Servicedue to SYN Flood attacks. Taking this into consideration, the customer’s solution should have the followingrequirements:- management requires network-based content filtering with man-in-the-middle inspection- the customer has no existing public key infrastructure but requires centralized certificate management- users are tracked by their active directory username without installing any software on their hosts- Web servers that have been exploited need to be protected from the OWASP Top 10- notification of high volume SYN Flood attacks when a threshold has been triggered

Which three solutions satisfy these requirements? (Choose three.)


A. FortiGate

B. FortiClient

C. FortiWeb

D. FortiAuthenticator

E. FortiDDOS

Correct Answer: ACESection: (none)Explanation


QUESTION 26


A customer just bought an additional FortiGate device and plans to use their existing load balancer todistribute traffic across two FortiGate units participating on a BGP network serving different neighbors. Thecustomer has mixed traffic of IPv4 and IPv6 TCP, UDP, and ICMP. The two FortiGate devices shown in theexhibit should be redundant to each other so that the NAT session and active session tables willsynchronize and fail over to the unit that is still operating without any loss of data if one of the units fail.Which high availability solution would you implement?

A. FortiGate Cluster Protocol (FGCP)

B. Fortinet redundant UTM protocol (FRUP)

C. FortiGate Session Life Support Protocol (FGSP)

D. Virtual Router Redundancy Protocol (VRRP)


Explanation/Reference:References:http://docs.fortinet.com/uploaded/files/1074/fortigate-ha-40-mr2.pdf

QUESTION 27A university is looking for a solution with the following requirements:- wired and wireless connectivity- authentication (LDAP)- Web filtering, DLP and application control- data base integration using LDAP to provide access to those students who are up-to-date with theirmonthly payments- support for an external captive portal

Which solution meets these requirements?

A. FortiGate for wireless controller and captive portalFortiAP for wireless connectivityFortiAuthenticator for user authentication and REST API for DB integrationFortiSwitch for PoE connectivityFortiAnalyzer for log and report

B. FortiGate for wireless controllerFortiAP for wireless connectivityFortiAuthenticator for user authentication, captive portal and REST API for DB integrationFortiSwitch for PoE connectivityFortiAnalyzer for log and report

C. FortiGate for wireless control and user authenticationFortiAuthenticator for captive portal and REST API for DB integrationFortiAP for wireless connectivity


FortiSwitch for PoE connectivityFortiAnalyzer for log and report

D. FortiGate for wireless controllerFortiAP for wireless connectivity and captive portalFortiSwitch for PoE connectivityFortiAuthenticator for user authentication and REST API for DB integrationFortiAnalyzer for log and reports



QUESTION 28

A customer wants to secure the network shown in the exhibit with a full redundancy design.Which security design would you use?

A. Place a FortiGate FGCP Cluster between DD and AA, then connect it to SW1, SW2, SW3, and SW4.

B. Place a FortiGate FGCP Cluster between BB and CC, then connect it to SW1, SW2, SW3, and SW4.

C. Place a FortiGate FGCP Cluster between BB and AA, then connect it to SW1, SW2, SW3, and SW4.

D. Place a FortiGate FGCP Cluster between DD and FF, then connect it to SW1, SW2, SW3, and SW4.



QUESTION 29A customer has the following requirements:- local peer with two Internet links- remote peer with one Internet link- secure traffic between the two peers- granular control with Accept policies

Which solution provides security and redundancy for traffic between the two peers?

A. a fully redundant VPN with interface mode configuration

B. a partially redundant VPN with interface mode configuration


C. a partially redundant VPN with tunnel mode configuration

D. a fully redundant VPN with tunnel mode configuration



QUESTION 30

How would you apply security to the network shown in the exhibit?


A. Replace RW1 with a ruggedized FortiGate and RW2 with a normal FortiGate. Enable industrial categoryon the application control. Place a FortiGate to secure Web servers. Configure IPsec to secure sensorsdata. Place a ruggedized FortiAP to provide Wi-Fi to the sensors.

B. Replace RW1 with a normal FortiGate and RW2 with a ruggedized FortiGate. Enable industrial categoryon the application control. Place a FortiGate to secure Web servers. Configure IPsec to secure sensorsdata. Place a FortiAP to provide Wi-Fi to the sensors.

C. Replace RW1 with a normal FortiGate and RW2 with a ruggedized FortiGate. Enable industrial categoryon the Web filter. Place a FortiWeb to secure Web servers. Configure IPsec to secure sensors data.Place a ruggedized FortiAP to provide Wi-Fi to the sensors.

D. Replace RW1 with a normal FortiGate and RW2 with a ruggedized FortiGate. Enable industrial categoryon the application control. Place a FortiWeb to secure Web servers. Configure IPsec to secure sensorsdata. Place a ruggedized FortiAP to provide Wi-Fi to the sensors.



QUESTION 31Your marketing department uncompressed and executed a file that the whole department received usingSkype.


Reviewing the exhibit, which two details do you determine from your initial analysis of the payload?

A. The payload contains strings that the malware is monitoring to harvest credentials.

B. This is a type of Trojan that will download and pirate movies using your Netflix credentials.

C. This type of threat of a DDoS attack using instant messaging to send e-mails to further spread theinfection.

D. This threat payload is uploading private user videos which are then used to extort Bitcoin payments.



QUESTION 32Which VPN protocol is supported by FortiGate units?

A. E-LAN

B. PPTP

C. DMVPN

D. OpenVPN

Correct Answer: BCSection: (none)Explanation


QUESTION 33You have replaced an explicit proxy Web filter with a FortiGate. The human resources department requiresthat all URLs be logged. Users are reporting that their browsers are now indicating certificate errors asshown in the exhibit.


Which step is a valid solution to the problem?

A. Make sure that the affected users’ browsers are no longer set to use the explicit proxy.

B. Import the FortiGate’s SSL CA certificate into the Web browsers.

C. Change the Web filter policies on the FortiGate to only do certificate inspection.

D. Make a Group Policy to install the FortiGate’s SSL certificate as a trusted host certificate on the Webbrowser.


Explanation/Reference:Explanation:For https traffic inspection, client machine should install fortigate’s ssl certificate


nse8 fortinet - gratis exam · the exhibit shows an ldap server configuration in a fortigate...

Documents