Refer to the exhibits.A FortiGate cluster (CL-1) protects a data center hosting multiple web applications. A pair of FortiADC devices are already configured for SSL decryption (FAD-1), and re-encryption (FAD-2). CL-1 must accept unencrypted traffic from FAD-1, perform application detection on the plain-text traffic, and forward the inspected traffic to FAD-2.The SSL-Offload-App-Detect application list and SSL-Offload protocol options profile are applied to the firewall policy handling the web application traffic on CL-1.Given this scenario, which two configuration tasks must the administrator perform on CL-1? (Choose two.)A)B)C)D)
Answer(s): B,C
To enable application detection on plain-text traffic that has been decrypted by FortiADC, the administrator must perform two configuration tasks on CL-1:Enable SSL offloading in the firewall policy and select the SSL-Offload protocol options profile. Enable application control in the firewall policy and select the SSL-Offload-App-Detect application list.
https://docs.fortinet.com/document/fortigate/6.4.0/cookbook/103438/application- detection-on-ssl-offloaded-traffic
You are migrating the branches of a customer to FortiGate devices. They require independent routing tables on the LAN side of the network.After reviewing the design, you notice the firewall will have many BGP sessions as you have two data centers (DC) and two ISPs per DC while each branch is using at least 10 internal segments. Based on this scenario, what would you suggest as the more efficient solution, considering that in the future the number of internal segments, DCs or internet links per DC will increase?
Answer(s): D
https://docs.fortinet.com/document/fortigate/7.4.1/administration-guide/810981/sd-wan- segmentation-over-a-single-overlay
You must analyze an event that happened at 20:37 UTC. One log relevant to the event is extracted from FortiGate logs:The devices and the administrator are all located in different time zones Daylight savings time (DST) is disabled· The FortiGate is at GMT-1000.· The FortiAnalyzer is at GMT-0800· Your browser local time zone is at GMT-03.00You want to review this log on FortiAnalyzer GUI, what time should you use as a filter?
https://community.fortinet.com/t5/FortiAnalyzer/Technical-Note-Understanding-FortiAnalyzer-time- related-fields/ta-p/197569
A customer is planning on moving their secondary data center to a cloud-based laaS. They want to place all the Oracle-based systems Oracle Cloud, while the other systems will be on Microsoft Azure with ExpressRoute service to their main data center.They have about 200 branches with two internet services as their only WAN connections. As a security consultant you are asked to design an architecture using Fortinet products with security, redundancy and performance as a priority.Which two design options are true based on these requirements? (Choose two.)
A . Systems running on Azure will need to go through the main data center to access the services on Oracle Cloud. This is because the Oracle Cloud is not directly connected to the Azure Cloud. The traffic will need to go through the main data center in order to reach the Oracle Cloud. C . Branch FortiGate devices must be configured as VPN clients for the branches' internal network to be able to access Oracle services without using public IPs. This is because the Oracle Cloud does not allow direct connections from the internet. The traffic will need to go through the FortiGate devices in order to reach the Oracle Cloud.The other options are not correct.B . Use FortiGate VM for IPSEC over ExpressRoute, as traffic is not encrypted by Azure. This is not necessary. Azure does encrypt traffic over ExpressRoute. D . Two ExpressRoute services to the main data center are required to implement SD-WAN between a FortiGate VM in Azure and a FortiGate device at the data center edge. This is not necessary. A single ExpressRoute service can be used to implement SD-WAN between a FortiGate VM in Azure and a FortiGate device at the data center edge.https://learn.microsoft.com/en-us/azure/expressroute/expressroute-about-encryption
Refer to the exhibit, which shows the high availability configuration for the FortiAuthenticator (FAC1).Based on this information, which statement is true about the next FortiAuthenticator (FAC2) member that will join an HA cluster with this FortiAuthenticator (FAC1)?
Answer(s): B
https://docs.fortinet.com/document/fortiauthenticator/6.5.3/administration-guide/122076/high- availability https://docs.fortinet.com/document/fortiauthenticator/6.5.3/administration-guide/122076/high- availability#Standalo
Post your Comments and Discuss Fortinet NSE8_812 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the NSE8_812 content, but please register or login to continue.