Fortinet Network Security Expert 8 Written Exam (NSE8 801 - FortiOS 5.2)

Question 1

Your company uses a cluster of two FortiGate 3600C units in active-passive mode to protect the
corporate network. The FortiGate cluster sends its logs to a FortiAnalyzer and you have configured
scheduled weekly reports for the Internet bandwidth usage of each corporate VLAN. During a scheduled
maintenance window, you make a series of configuration changes. When the next FortiAnalyzer weekly
report is generated, you notice that Internet bandwidth usage reported by the FortiAnalyzer is far less than
expected.
What is the reason for this discrepancy?

A. You enabled HA session-pickup, which is turn disabled session accounting.

B. You changed from active-passive to active-active, causing the session traffic counters to become
inaccurate.

C. You disabled all security profiles on some of the firewall policies, and the traffic matching those policies
is now accelerated.

D. You applied an antivirus profile on some of the policies, and no traffic can be accelerated.

Correct Answer: B

Question 2

Given the following FortiOS 5.2 commands:

Which vulnerability is being addresses when managing FortiGate through an encrypted management
protocol?

A. Remote Exploit Vulnerability in Bash (ShellShock)

B. Information Disclosure Vulnerability in OpenSSL (Heartbleed)

C. SSL/TLS MITM vulnerability (CVE-2014-0224)

D. SSL v3 POODLE Vulnerability

Correct Answer: D

Question 3

Referring to the exhibit, you want to know if aggregating port7 and port22 will work.
Which statement is correct?

A. Yes, LACP is supported on ports that are linked together with integrated Switch Fabric.

B. No, LACP is not supported on NP6 platforms.

C. No, LACP is only supported on ports connected to the same NP6.

D. Yes, LACP is supported on all ports regardless if they are connected to the same NP6.

Correct Answer: C

Question 4

Which three configuration scenarios will result in an IPsec negotiation failure between two FortiGate
devices? (Choose three.)

A. mismatched phase 2 selectors

B. mismatched Anti-Replay configuration

C. failed Dead Peer Detection negotiation

D. mismatched Perfect Forward Secrecy

E. mismatched IKE version

Correct Answer: D

Question 5

Referring to the exhibit, which statement is true?

A. The packet did not match any of the local IPsec SAs.

B. The packet failed the HMAC validation.

C. The packet was protected with an unsupported encryption algorithm.

D. The IPsec negotiation failed because the SPI was unknown.

Correct Answer: B

Question 6

FortiGatel has a gateway-to-gateway IPsec VPN to FortiGate2. The entire IKE negotiation between
FortiGatel and FortiGate2 is on UDP port 500. A PC on FortuGate2's local area network is sending
continuous ping requests over the VPN tunnel to a PC of FortiGatel's local area network. No other traffic is
sent over the tunnel.
Which statement is true on this scenario?

A. FortiGatel sends an R-U-TH ERE packet every 300 seconds while ping traffic is flowing.

B. FortiGatel sends an R-U-TH ERE packet if pings stop for 300 seconds and no IKE packet is received
during this period.

C. FortiGatel sends an R-U-THERE packet if pings stop for 60 seconds and no IKE packet is received
during this period.

D. FortiGatel sends an R-U-TH ERE packet every 60 seconds while ping traffic is flowing.

Correct Answer: C

Question 7

A customer wants to implement a RADIUS Single Sign On (RSSO) solution for multiple FortiGate devices.
The customer's network already includes a RADIUS server that can generate the logon and logoff accounting records.
However, the RADIUS server can send those records to only one destination.
What should the customer do to overcome this limitation?

A. Send the RADIUS records to an LDAP server and add the LDAP server to the FortiGate configuration .

B. Use the RADIUS accounting proxy feature available in FortiAuthenticator devices.

C. Send the RADIUS records to one of the FortiGate devices, which can replicate them to the other FortiGate units.

D. Send the RADIUS records to an RSSO Collector Agent.

Correct Answer: D

Fortinet Network Security Expert 8 Written Exam (NSE8 801 - FortiOS 5.2) - NSE8 Exam Practice Test

Latest Update

Useful Links

Contact Us