QUESTION: 9

An HA topology is using the following configuration:

Based on this configuration, how long will it take for a failover to be detected by the secondary cluster member?

600ms
200ms
300ms
100ms

Answer(s): B

Explanation:

The HA heartbeat interval is 100ms, and the number of lost heartbeats before a failover is detected is 2. So, it will take 2 * 100ms = 200ms for a failover to be detected by the secondary cluster member.

Reference:

FortiGate High Availability: https://docs.fortinet.com/document/fortigate/7.0.0/administration- guide/647723/link-monitoring-and-ha-failover-time

Reveal Solution Next Question

QUESTION: 10

Refer to the exhibit.

You have deployed a security fabric with three FortiGate devices as shown in the exhibit. FGT_2 has the following configuration:

FGT_1 and FGT_3 are configured with the default setting.
Which statement is true for the synchronization of fabric-objects?

Objects from the FortiGate FGT_2 will be synchronized to the upstream FortiGate.
Objects from the root FortiGate will only be synchronized to FGT__2.
Objects from the root FortiGate will not be synchronized to any downstream FortiGate.
Objects from the root FortiGate will only be synchronized to FGT_3.

Answer(s): C

Explanation:

The fabric-object-unification setting on FGT_2 is set to local, which means that objects will not be synchronized to any other FortiGate devices in the security fabric. The default setting for fabric- object-unification is default, which means that objects will be synchronized from the root FortiGate to all downstream FortiGate devices.
Since FGT_2 is not the root FortiGate and the fabric-object-unification setting is set to local, objects from the root FortiGate will not be synchronized to FGT_2.

Reference:

Synchronizing objects across the Security Fabric:
https://docs.fortinet.com/document/fortigate/6.4.0/administration-guide/880913/synchronizing- objects-across-the-security-fabric

Reveal Solution Next Question

QUESTION: 11

Refer to the exhibit.

You are operating an internal network with multiple OSPF routers on the same LAN segment. FGT_3

needs to be added to the OSPF network and has the configuration shown in the exhibit. FGT_3 is not establishing any OSPF connection.
What needs to be changed to the configuration to make sure FGT_3 will establish OSPF neighbors without affecting the DR/BDR election?

Answer(s): B

Explanation:

The OSPF configuration shown in the exhibit is using the default priority value of 1 for the interface port1. This means that FGT_3 will participate in the DR/BDR election process with the other OSPF routers on the same LAN segment. However, this is not desirable because FGT_3 is a new device that needs to be added to the OSPF network without affecting the existing DR/BDR election. Therefore, to make sure FGT_3 will establish OSPF neighbors without affecting the DR/BDR election, the priority value of the interface port1 should be changed to 0. This will prevent FGT_3 from becoming a DR or BDR and allow it to form OSPF adjacencies with the current DR and BDR. Option B shows the correct configuration that changes the priority value to 0. Option A is incorrect because it does not change the priority value. Option C is incorrect because it changes the network type to point-to-point, which is not suitable for a LAN segment with multiple OSPF routers. Option D is incorrect because it changes the area ID to 0.0.0.1, which does not match the area ID of the other OSPF routers on the same LAN segment.

Reference:

https://docs.fortinet.com/document/fortigate/7.0.0/administration- guide/358640/basic-ospf-example

Reveal Solution Next Question

QUESTION: 12

A retail customer with a FortiADC HA cluster load balancing five webservers in L7 Full NAT mode is receiving reports of users not able to access their website during a sale event. But for clients that were able to connect, the website works fine.
CPU usage on the FortiADC and the web servers is low, application and database servers are still able to handle more traffic, and the bandwidth utilization is under 30%.
Which two options can resolve this situation? (Choose two.)

Change the persistence rule to LB_PERSIS_SSL_SESSJD.
Add more web servers to the real server poof
Disable SSL between the FortiADC and the web servers
Add a connection-pool to the FortiADC virtual server

Answer(s): B,D

Explanation:

Option B: Adding more web servers to the real server pool will increase the overall capacity of the load balancer, which should help to resolve the issue of users not being able to access the website. Option D: Adding a connection-pool to the FortiADC virtual server will allow the load balancer to cache connections to the web servers, which can help to improve performance and reduce the number of dropped connections.
Option A: Changing the persistence rule to LB_PERSIS_SSL_SESSJD would only be necessary if the current persistence rule is not working properly. In this case, the CPU usage on the FortiADC and the web servers is low, so the persistence rule is likely not the issue. Option C: Disabling SSL between the FortiADC and the web servers would reduce the load on the FortiADC, but it would also make the website less secure. Since the bandwidth utilization is under 30%, it is unlikely that disabling SSL would resolve the issue.

Reference:

https://docs.fortinet.com/document/fortiadc/7.2.1/handbook/970956/configuring- virtual-servers

Reveal Solution Next Question

Free NSE8_812 Exam Braindumps (page: 3)

QUESTION: 9

Explanation:

Reference:

QUESTION: 10

Explanation:

Reference:

QUESTION: 11

Explanation:

Reference:

QUESTION: 12

Explanation:

Reference: