Question 1

Refer to the exhibit showing FortiGate configurations

FortiManager VM high availability (HA) is not functioning as expected after being added to an existing

deployment.

The administrator finds that VRRP HA mode is selected, but primary and secondary roles are greyed out in the

GUI The managed devices never show online when FMG-B becomes primary, but they will show online

whenever the FMG-A becomes primary.

What change will correct HA functionality in this scenario?

Options :

A : Change the FortiManager IP address on the managed FortiGate to 10.3.106.65.

B : Make the monitored IP to match on both FortiManager devices.

C : Unset the primary and secondary roles in the FortiManager CLI configuration so VRRP will decide who is primary.

D : Change the priority of FMG-A to be numerically lower for higher preference

Answer: B

Question 2

A customer's cybersecurity department needs to implement security for the traffic between two VPCs in AWS,

but these belong to different departments within the company. The company uses a single region for all their

VPCs.

Which two actions will achieve this requirement while keeping separate management of each department's

VPC? (Choose two.)

Options :

A : Create a transit VPC with a FortiGate HA cluster, connect to the other two using VPC peering, and use routing tables to force traffic through the FortiGate cluster.

B : Create an 1AM account for the cybersecurity department to manage both existing VPC, create a FortiGate HA Cluster on each VPC and IPSEC VPN to force traffic between the VPCs through the FortiGate clusters

C : Migrate all the instances to the same VPC and create 1AM accounts for each department, then implement a new subnet for a FortiGate auto-scaling group and use routing tables to force the traffic through the FortiGate cluster.

D : Create a VPC with a FortiGate auto-scaling group with a Transit Gateway attached to the three VPC to force routing through the FortiGate cluster

Answer: A,D

Question 3

Refer to the exhibits, which show a network topology and VPN configuration.

A network administrator has been tasked with modifying the existing dial-up IPsec VPN infrastructure to detect the path quality to the remote endpoints. After applying the configuration shown in the configuration exhibit, the VPN clients can still connect and access the protected 172.16.205.0/24 network, but no SLA information shows up for the client tunnels when issuing the diagnose sys link-monitor tunnel all command on the FortiGate CLI. What is wrong with the configuration?

Options :

A : SLA link monitoring does not work with the net-device setting.

B : The admin needs to disable the mode-cfg setting.

C : IPsec Phase1 Interface has to be configured in IPsec main mode.

D : It is necessary to use the IKEv2 protocol in this situation.

Answer: A

Question 4

Refer to the exhibit.

To facilitate a large-scale deployment of SD-WAN/ADVPN with FortiGate devices, you are tasked with

configuring the FortiGate devices to support injecting of IKE routes on the ADVPN shortcut tunnels.

Which three commands must be added or changed to the FortiGate spoke config vpn ipsec phasei-interface

options referenced in the exhibit for the VPN interface to enable this capability? (Choose three.)

Options :

A : set net-device disable

B : set mode-cfg enable

C : set ike-version 1

D : set add-route enable

E : set mode-cfg-allow-client-selector enable

Answer: A,D

Question 5

Refer to the exhibits.

A FortiGate cluster (CL-1) protects a data center hosting multiple web applications. A pair of FortiADC

devices are already configured for SSL decryption (FAD-1), and re-encryption (FAD-2). CL-1 must accept

unencrypted traffic from FAD-1, perform application detection on the plain-text traffic, and forward the

inspected traffic to FAD-2.

The SSL-Offload-App-Detect application list and SSL-Offload protocol options profile are applied to the

firewall policy handling the web application traffic on CL-1.

Given this scenario, which two configuration tasks must the administrator perform on CL-1? (Choose two.)

Options :

A :

B :

C :

D :

Answer: B,C

Free NSE8_812 Mock Exam – Practice Online Confidently

Buying Options: