Fortinet NSE8_811 Exam : Fortinet NSE 8 Written Exam (NSE8_811)

Click the Exhibit button.
Your customer is using dynamic routing to exchange the default route between two FortiGates using OSPFv2. The output of the get router info ospf neighbor command shows that the neighbor is up, but the default route does not appear in the routing neighbor shown below:

According to the exhibit, what is causing the problem?

• A. There is an OSPF interface network-type mismatch.
• B. FG2 is within the wrong OSPF area.
• C. A prefix for the detail route is missing
• D. OSPF requires the redistribution of connected networks.

You want to manage a FortiCloud service. The FortiGate shows up in your list devices on the FortiCloud Web site, but all management functions are either missing or grayed out.
Which statement a correct in this scenario?

• A. The managed FcrtGate a running a version of ForflOS that is either too new or too for FortCloud.
• B. The management tunnel mode on the managed FortiGate must be changed to normal.
• C. You must manually configure system control-management on the FortiGate CLI and set the management type to fortiguard.
• D. The managed FortiGate requires that a FortiCloud management license be purchased and applied.

Click the Exhibit button.
config system ha
set mode a-a
set group-id 1
set group-name main
set hb_dev port2 100
set session-pickup enable
end
You have configured an HA cluster with two FortiGates. You want to make sure that you are able to manage the individual cluster members directly using port3.
Referring to the exhibit, what are two ways to accomplish this task? (Choose two.)

• A. Configure port3 to be a dedicated HA management interface, then configure specific IPs for port3 on both cluster members.
• B. Create a management VDOM and Disable the HA synchronization for this VDOM, assign ports to this VDOM, then configure specific IPs for ports on both cluster member.
• C. Allow administrative access in the HA heartbeat interfaces.
• D. Disable the sync feature on porl3: then configure specific IPs for ports on both cluster members.

You configured a firewall policy with only a Web filter profile for accessing the Internet. Access to websites belonging to the "Information Technology" category are blocked and to the "Business" category are allowed. SSL deep inspection is not enabled on this policy.
A user wants to access the website https://www.it-acme.com which presents a certificate with CN=www.acme.com. The it-acme.com domain is categorized as "Information Technology" and the acme.com domain is categorized as "Business".
Which statement regarding this scenario is correct?

• A. The website will be allowed by category "Business" as the certificate name takes precedence over the
  URL.
• B. The website will be blocked by category "Information Technology" as the SNI takes precedence over the certificate name.
• C. Only with SSL deep inspection enabled will the FortiGate be able to categorized this website.
• D. The FortiGate is able to read the URL within HTTPS sessions when using SSL certificate inspection so the website will be blocked by the "Information Technology".

Exhibit

You created a custom health-check for your FortiWeb deployment.
Referring to the output shown in the exhibit, which statement is true?

• A. The FortiWeb must match the hash value of the page index html.
• B. The FortiWeb must receive an HTTP 200 response code from the server.
• C. The FortiWeb must receive an RST packet from the server.
• D. The FortiWeb must receive an ICMP Echo Request from the server.