Fortinet NSE 8 - Recertification 認定 NSE8_813 試験問題:

1. A Hub FortiGate is connecting multiple branch FortiGate devices separating the traffic centrally in unique VRFs. Routing information is exchanged using BGP between the Hub and the Branch FortiGate devices.
You want to efficiently enable route leaking of specific routes between the VRFs.
Which two steps are required to achieve this requirement? (Choose two.)

A) Enable BGP recursive routing on the HUB FortiGate
B) Configure route-maps to leak the selected routes using BGP
C) Create a vdom link between VRF10 and VRF12
D) Enable Multi-VDOM mode on the Hub FortiGate and add a VDOM to connect VRF10 and VRF12

2. An administrator reports continuous high CPU utilization on a FortiGate device due to the IPS engine.
Consider the global IPS configuration shown below.

Which two configuration actions will reduce the CPU usage? (Choose two.)

A) Increase engine-count to 2.
B) Disable fail open.
C) Enable intelligent mode.
D) Reduce the number of packets being logged.

3. Referring to the exhibit, you want to know if aggregating port7 and port22 will work.
Which statement is correct?

A) Yes, LACP is supported on all ports regardless if they are connected to the same NP6.
B) Yes, LACP is supported on ports that are linked together with integrated Switch Fabric.
C) No, LACP is only supported on ports connected to the same NP6.
D) No, LACP is not supported on NP6 platforms.

4. Refer to the exhibits.
GUI Access

Configuration

Topology

An administrator has configured a FortiGate and FortiAuthenticator for two-factor authentication with FortiToken push notifications for their SSL VPN login. Upon initial review of the setup, the administrator has discovered that the customers can manually type in their two-factor code and authenticate but push notifications.
Based on the information given in the exhibits, what must be done to fix this?

A) On FAC-1, the FortiToken public IP setting must point to 100.64.1.41.
B) FAC-1 must have an internet routable IP address for push notifications.
C) On FG-1 CLI, the ftm-push server setting must point to 100.64.1.41.
D) On FG-1 port1, the ftm access protocol must be enabled.

5. A company wants to protect against Denial of Service attacks and has launched a new project.
They want to block the attacks that go above a certain threshold and for some others they are just trying to get a baseline of activity for those types of attacks so they are letting the traffic pass through without action.
Given the following:
- The interface to the Internet is on WAN1.
- There is no requirement to specify which addresses are being
protected or protected from.
- The protection is to extend to all services.
- The tcp_syn_flood attacks are to be recorded and blocked.
- The udp_flood attacks are to be recorded but not blocked.
- The tcp_syn_flood attack's threshold is to be changed from the
default to 1000.
The exhibit shows the current DoS-policy.
Which policy will implement the project requirements?

A)

B)

C)

D)

質問と回答：