QUESTION: 25

Refer to the exhibit.

A VPN IPsec is connecting the headquarters office (HQ) with a branch office (BO). OSPF is used to redistribute routes between the offices. After deployment, a server with IP address 10.10.10.35 located on the DMZ network of the BO FortiGate, was reported unreachable from hosts located on the LAN network of the same FortiGate.

Referring to the exhibit, which statement is true?

The ICMP packets are being blocked by an implicit deny policy.
A directly connected subnet is being partially superseded by an OSPF redistributed subnet.
Enabling NAT on the VPN firewall policy will solve the problem.
The incoming access list should have an accept action instead of a deny action to solve the problem.

Answer(s): B

Reveal Solution Next Question

QUESTION: 26

A customer has a SCADA environmental control device that is triggering a false-positive IPS alert whenever the Web GUI of the device is accessed. You cannot create a functional custom IPS filter to exempt this behavior, and it appears that the device is so old that it does not have HTTPS support. You need to prevent the false positive IPS alerts from occurring.

In this scenario, which two actions will accomplish this task? (Choose two.)

Create a URL filter with the Exempt action for that device IP address.
Change the relevant firewall policies to use SSL certificate-inspection instead of SSL deep-inspection.
Create a very specific firewall policy for that device IP address which does not perform IPS scanning.
Reconfigure the FortiGate to operate in proxy-based inspection mode instead of flow-based.

Answer(s): A,C

Reveal Solution Next Question

QUESTION: 27

Refer to the exhibit.

The FortiAP profile used by the FortiGate managed AP is shown in the exhibit.

Which two statements in this scenario are correct? (Choose two.)

Interference will be prevented between FortiAP devices using this profile.
This profile will map specific SSIDs available to the FortiAP devices.
All FortiAP devices using this profile will have Radio 1 monitor wireless clients.
All FortiAP devices using this profile will have Radio 1 scan rogue access points.

Answer(s): B,D

Reveal Solution Next Question

QUESTION: 28

Refer to the exhibit.

The exhibit shows a topology where a FortiGate is split into two VDOMs, root and vd-lan. The root VDOM provides external SSL-VPN access, where the users are authenticated by a FortiAuthenticator. The vd-lan VDOM provides internal access to a Web server.

For the remote users to access the internal Web server, there are a few requirements as follows:

-All traffic must come from the SSL-VPN.
-The vd-lan VDOM only allows authenticated traffic to the Web server.
-Users must only authenticate once, using the SSL-VPN portal.
-SSL-VPN uses RADIUS-based authentication.

Given these requirements and the topology shown in the exhibit, which two statements are true? (Choose two.)

vd-lan connects to FortiAuthenticator as a regular FSSO client.
root is configured for FSSO while vd-lan is configured for RSSO.
root sends "RADIUS Accounting Messages" to FortiAuthenticator
vd-lan receives authentication messages from root using FSSO.

Answer(s): A,C

Reveal Solution Next Question

Free NSE8_811 Exam Braindumps (page: 7)

QUESTION: 25

QUESTION: 26

QUESTION: 27

QUESTION: 28