Cisco®
CompTIA
Checkpoint
ISC
EC-Council
EXIN
Fortinet
ITIL®
Juniper
Microsoft
VMware
Avaya
SAP
Google
Salesforce
Amazon
Palo Alto Networks
ISC2
All Vendors
  2. Home
  3. Exams
  4. Fortinet
  5. NSE8_812

Free Fortinet NSE8_812 Exam Questions (page: 3)

Page 3 of 28
PDF with 118 Questions

You are troubleshooting a FortiMail Cloud service integrated with Office 365 where outgoing emails are not reaching the recipients' mail What are two possible reasons for this problem? (Choose two.)

  1. The FortiMail access control rule to relay from Office 365 servers FQDN is missing.
  2. The FortiMail DKIM key was not set using the Auto Generation option.
  3. The FortiMail access control rules to relay from Office 365 servers public IPs are missing.
  4. A Mail Flow connector from the Exchange Admin Center has not been set properly to the FortiMail Cloud FQDN.

Answer(s): A,C

Explanation:

A . The FortiMail access control rule to relay from Office 365 servers FQDN is missing. If the access control rule to relay from Office 365 servers FQDN is missing, then FortiMail will not be able to send emails to Office 365. This is because the access control rule specifies which IP addresses or domains are allowed to relay emails through FortiMail. D . A Mail Flow connector from the Exchange Admin Center has not been set properly to the FortiMail Cloud FQDN.

If the Mail Flow connector from the Exchange Admin Center is not set properly to the FortiMail Cloud FQDN, then Office 365 will not be able to send emails to FortiMail. This is because the Mail Flow connector specifies which SMTP server is used to send emails to external recipients.



Refer to the exhibit.



FortiManager is configured with the Jinja Script under CLI Templates shown in the exhibit.
Which two statements correctly describe the expected behavior when running this template? (Choose two.)

  1. The Jinja template will automatically map the interface with "WAN" role on the managed FortiGate.
  2. The template will work if you change the variable format to $(WAN).
  3. The template will work if you change the variable format to {{ WAN }}.
  4. The administrator must first manually map the interface for each device with a meta field.
  5. The template will fail because this configuration can only be applied with a CLI or TCL script.

Answer(s): D,E

Explanation:

D . The administrator must first manually map the interface for each device with a meta field. The Jinja template in the exhibit is expecting a meta field called WAN to be set on the managed FortiGate. This meta field will specify which interface on the FortiGate should be assigned the "WAN" role. If the meta field is not set, then the template will fail.

E . The template will fail because this configuration can only be applied with a CLI or TCL script. The Jinja template in the exhibit is trying to configure the interface role on the managed FortiGate. This type of configuration can only be applied with a CLI or TCL script. The Jinja template will fail because it is not a valid CLI or TCL script.



SD-WAN is configured on a FortiGate. You notice that when one of the internet links has high latency the time to resolve names using DNS from FortiGate is very high. You must ensure that the FortiGate DNS resolution times are as low as possible with the least amount of work.
What should you configure?

  1. Configure local out traffic to use the outgoing interface based on SD-WAN rules with a manual defined IP associated to a loopback interface and configure an SD-WAN rule from the loopback to the DNS server.
  2. Configure an SD-WAN rule to the DNS server and use the FortiGate interface IPs in the source address.
  3. Configure two DNS servers and use DNS servers recommended by the two internet providers.
  4. Configure local out traffic to use the outgoing interface based on SD-WAN rules with the interface IP and configure an SD-WAN rule to the DNS server.

Answer(s): D

Explanation:

SD-WAN is a feature that allows users to optimize network performance and reliability by using multiple WAN links and applying rules based on various criteria, such as latency, jitter, packet loss, etc. One way to ensure that the FortiGate DNS resolution times are as low as possible with the least amount of work is to configure local out traffic to use the outgoing interface based on SD-WAN rules with the interface IP and configure an SD-WAN rule to the DNS server. This means that the FortiGate will use the best WAN link available to send DNS queries to the DNS server according to the SD-WAN rule, and use its own interface IP as the source address. This avoids NAT issues and ensures optimal DNS performance.


Reference:

https://docs.fortinet.com/document/fortigate/7.0.0/sd- wan/19662/sd-wan



Refer to the exhibits.
Exhibit A



Exhibit B



Exhibit C



A customer is trying to set up a VPN with a FortiGate, but they do not have a backup of the configuration. Output during a troubleshooting session is shown in the exhibits A and B and a baseline VPN configuration is shown in Exhibit C Referring to the exhibits, which configuration will restore VPN connectivity?
A)



B)



C)



D)

  1. Option A
  2. Option B
  3. Option C
  4. Option D

Answer(s): C

Explanation:

The output in Exhibit A shows that the VPN tunnel is not established because the peer IP address is incorrect. The output in Exhibit B shows that the peer IP address is 192.168.1.100, but the baseline VPN configuration in Exhibit C shows that the peer IP address should be 192.168.1.101. To restore VPN connectivity, you need to change the peer IP address in the VPN tunnel configuration to 192.168.1.101. The correct configuration is shown below:
config vpn ipsec phase1-interface edit "wan"
set peer-ip 192.168.1.101
set peer-id 192.168.1.101
set dhgrp 1
set auth-mode psk set psk SECRET_PSK
next end
Option A is incorrect because it does not change the peer IP address. Option B is incorrect because it changes the peer IP address to 192.168.1.100, which is the incorrect IP address. Option D is incorrect because it does not include the necessary configuration for the VPN tunnel.



Viewing page 3 of 28



Post your Comments and Discuss Fortinet NSE8_812 exam prep with other Community members:

NSE8_812 Exam Discussions & Posts