Special Summer Sale 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: save70

Free NSE8_812 Questions Attempt

Page: 5 / 8
Total 105 questions

Network Security Expert 8 Written Exam Questions and Answers

Question 17

Refer to the exhibits.

An administrator has configured a FortiGate and Forti Authenticator for two-factor authentication with FortiToken push notifications for their SSL VPN login. Upon initial review of the setup, the administrator has discovered that the customers can manually type in their two-factor code and authenticate but push notifications do not work

Based on the information given in the exhibits, what must be done to fix this?

Options:

A.

On FG-1 port1, the ftm access protocol must be enabled.

B.

FAC-1 must have an internet routable IP address for push notifications.

C.

On FG-1 CLI, the ftm-push server setting must point to 100.64.141.

D.

On FAC-1, the FortiToken public IP setting must point to 100.64.1 41

Question 18

An administrator has configured a FortiGate device to authenticate SSL VPN users using digital certificates. A FortiAuthenticator is the certificate authority (CA) and the OCSP server.

Part of the FortiGate configuration is shown below:

Based on this configuration, which authentication scenario will FortiGate deny?

Options:

A.

The user certificate does not contain the OCSP URL.

B.

FortiAuthenticator responds to an OCSP request that the user certificate authority is untrusted.

C.

FortiAuthenticator responds to an OCSP request that the user certificate status is unknown.

Question 19

SD-WAN is configured on a FortiGate. You notice that when one of the internet links has high latency the time to resolve names using DNS from FortiGate is very high.

You must ensure that the FortiGate DNS resolution times are as low as possible with the least amount of work.

What should you configure?

Options:

A.

Configure local out traffic to use the outgoing interface based on SD-WAN rules with a manual defined IP associated to a loopback interface and configure an SD-WAN rule from the loopback to the DNS server.

B.

Configure an SD-WAN rule to the DNS server and use the FortiGate interface IPs in the source address.

C.

Configure two DNS servers and use DNS servers recommended by the two internet providers.

D.

Configure local out traffic to use the outgoing interface based on SD-WAN rules with the interface IP and configure an SD-WAN rule to the DNS server.

Question 20

Refer to the exhibit.

An HTTPS access proxy is configured to demonstrate its function as a reverse proxy on behalf of the web server it is protecting. It verifies user identity, device identity, and trust context, before granting access to the protected source. It is assumed that the FortiGate EMS fabric connector has already been successfully connected.

You need to ensure that ZTNA access through the FortiGate will redirect users to the FortiAuthenticator to perform username/password and multifactor authentication to validate access prior to accessing resources behind the FortiGate.

In this scenario, which two further steps need to be taken on the FortiGate? (Choose two.)

Options:

A.

Create a SAML user/server object referring to the FortiAuthenticator.

B.

Create an authentication rule that sets the sso-auth-method to the FortiAuthenticator.

C.

Create an authentication scheme with the "method" as SAML.

D.

Create a firewall rule that allows access from the remote endpoint to the resources behind the FortiGate.

Page: 5 / 8
Total 105 questions