QUESTION: 17

Refer to the exhibits.

An administrator has configured a FortiGate and Forti Authenticator for two-factor authentication

with FortiToken push notifications for their SSL VPN login. Upon initial review of the setup, the administrator has discovered that the customers can manually type in their two-factor code and authenticate but push notifications do not work
Based on the information given in the exhibits, what must be done to fix this?

On FG-1 port1, the ftm access protocol must be enabled.
FAC-1 must have an internet routable IP address for push notifications.
On FG-1 CLI, the ftm-push server setting must point to 100.64.141.
On FAC-1, the FortiToken public IP setting must point to 100.64.1 41

Answer(s): B

Explanation:

FortiToken push notifications require that the FortiAuthenticator has an internet routable IP address. This is because the FortiAuthenticator uses this IP address to send push notifications to the FortiGate.
The other options are not correct. Enabling the ftm access protocol on FG-1 port1 is not necessary for push notifications to work. The ftm-push server setting on FG-1 CLI should already point to the FortiAuthenticator's IP address. The FortiToken public IP setting on FAC-1 is not relevant to push notifications.
Here is a table that summarizes the different options:

Reveal Solution Next Question

QUESTION: 18

Refer to the exhibit.

A customer has deployed a FortiGate 300E with virtual domains (VDOMs) enabled in the multi- VDOM mode. There are three VDOMs: Root is for management and internet access, while VDOM 1 and VDOM 2 are used for segregating internal traffic. AccountVInk and SalesVInk are standard VDOM links in Ethernet mode.

Given the exhibit, which two statements below about VDOM behavior are correct? (Choose two.)

You can apply OSPF routing on the VDOM link in either PPP or Ethernet mode
Traffic on AccountVInk and SalesVInk will not be accelerated.
The VDOM links are in Ethernet mode because they have IP addressed assigned on both sides.
Root VDOM is an Admin type VDOM, while VDOM 1 and VDOM 2 are Traffic type VDOMs.
OSPF routing can be configured between VDOM 1 and Root VDOM without any configuration changes to AccountVInk

Answer(s): A,D

Explanation:

A) You can apply OSPF routing on the VDOM link in either PPP or Ethernet mode. This is because VDOM links can be configured in either PPP or Ethernet mode, and OSPF routing can be configured on both types of links.
D) Root VDOM is an Admin type VDOM, while VDOM 1 and VDOM 2 are Traffic type VDOMs. This is because the Root VDOM is the default VDOM, and it is used for management and internet access. VDOM 1 and VDOM 2 are traffic type VDOMs, which are used for segregating internal traffic.
The other options are not correct.
B) Traffic on AccountVInk and SalesVInk will not be accelerated. This is because VDOM links are not accelerated by default. However, you can configure acceleration on VDOM links if you want.
C) The VDOM links are in Ethernet mode because they have IP addressed assigned on both sides. This is not necessarily true. The VDOM links could be in PPP mode even if they have IP addresses assigned on both sides.
E) OSPF routing can be configured between VDOM 1 and Root VDOM without any configuration changes to AccountVInk. This is correct. OSPF routing can be configured between any two VDOMs, even if they are not directly connected. In this case, the OSPF routing would be configured on the AccountVInk link.

Reveal Solution Next Question

QUESTION: 19

You are responsible for recommending an adapter type for NICs on a FortiGate VM that will run on an ESXi Hypervisor. Your recommendation must consider performance as the main concern, cost is not a factor.
Which adapter type for the NICs will you recommend?

Native ESXi Networking with E1000
Virtual Function (VF) PCI Passthrough
Native ESXi Networking with VMXNET3
Physical Function (PF) PCI Passthrough

Answer(s): C

Explanation:

The FortiGate VM is a virtual firewall appliance that can run on various hypervisors, such as ESXi, Hyper-V, KVM, etc. The adapter type for NICs on a FortiGate VM determines the performance and compatibility of the network interface cards with the hypervisor and the physical network. There are different adapter types available for NICs on a FortiGate VM, such as E1000, VMXNET3, SR-IOV, etc. If performance is the main concern and cost is not a factor, one option is to use native ESXi networking with VMXNET3 adapter type for NICs on a FortiGate VM that will run on an ESXi hypervisor. VMXNET3 is a paravirtualized network interface card that is optimized for performance in virtual machines and supports features such as multiqueue support, Receive Side Scaling (RSS), Large Receive Offload (LRO), IPv6 offloads, and MSI/MSI-X interrupt delivery. Native ESXi networking means that the FortiGate VM uses the standard virtual switch (vSwitch) or distributed virtual switch (dvSwitch) provided by the ESXi hypervisor to connect to the physical network. This option can provide high performance and compatibility for NICs on a FortiGate VM without requiring additional hardware or software components.

Reference:

https://docs.fortinet.com/document/fortigate/7.0.0/vm-installation-for-vmware- esxi/19662/installing-fortigate-vm-on-vmware-esxi
https://docs.fortinet.com/document/fortigate/7.0.0/vm-installation-for-vmware- esxi/19662/networking

Reveal Solution Next Question

QUESTION: 20

You are deploying a FortiExtender (FEX) on a FortiGate-60F. The FEX will be managed by the FortiGate. You anticipate high utilization. The requirement is to minimize the overhead on the device for WAN traffic.
Which action achieves the requirement in this scenario?

Add a switch between the FortiGate and FEX.
Enable CAPWAP connectivity between the FortiGate and the FortiExtender.
Change connectivity between the FortiGate and the FortiExtender to use VLAN Mode
Add a VLAN under the FEX-WAN interface on the FortiGate.

Answer(s): C

Explanation:

VLAN Mode is a more efficient way to connect a FortiExtender to a FortiGate than CAPWAP Mode. This is because VLAN Mode does not require the FortiExtender to send additional control traffic to the FortiGate.
The other options are not correct.
A) Add a switch between the FortiGate and FEX. This will add overhead to the network, as the switch will need to process the traffic.
B) Enable CAPWAP connectivity between the FortiGate and the FortiExtender. This will increase the overhead on the FortiGate, as it will need to process additional control traffic.
D) Add a VLAN under the FEX-WAN interface on the FortiGate. This will not affect the overhead on the FortiGate.

Reveal Solution Next Question

Free NSE8_812 Exam Braindumps (page: 5)

QUESTION: 17

Explanation:

QUESTION: 18

Explanation:

QUESTION: 19

Explanation:

Reference:

QUESTION: 20

Explanation: