最新のNSE8_811問題集で試験を準備する

Fortinet NSE8_811 試験概要:

Fortinet NSE8_811 試験シラバストピック:

Fortinet NSE 8 Written Exam (NSE8_811) 認定 NSE8_811 試験問題：

1. A customer has a SCADA environmental control device that is triggering a false-positive IPS alert whenever the Web GUI of the device is accessed. You cannot create a functional custom IPS filter to exempt this behavior, and it appears that the device is so old that it does not have HTTPS support. You need to prevent the false positive IPS alerts from occurring.
In this scenario, which two actions will accomplish this task? (Choose two.)

A) Create a URL filter with the Exempt action for that device IP address.
B) Create a very specific firewall policy for that device IP address which does not perform IPS scanning.
C) Change the relevant firewall policies to use SSL certificate-inspection instead of SSL deep-inspection.
D) Reconfigure the FortiGate to operate in proxy-based inspection mode instead of flow-based.

2. You deploy a FortiGate device in a remote office based on the requirements shown below.
-- Due to company's security policy, management IP of your FortiGate is not allowed to access the Internet.
-- Apply Web Filtering, Antivirus, IPS and Application control to the protected subnet.
-- Be managed by a central FortiManager in the head office.
Which action will help to achieve the requirements?

A) Configure FortiGate to use FortiGuard Filtering Port 8888.
B) Configure the FortiGuard override server and use the IP address of the FortiManager
C) Configure a default route and make sure that the FortiGate device can pmg to service fortiguard net.
D) Configure the FortiGuard override server and use the IP address of service, fortiguard net.

3. Click the Exhibit button.
Central NAT was configured on a FortiGate firewall. A sniffer shows ICMP packets out to a host on the Internet egresses with the port1 IP address instead of the virtual IP(VIP) that was configured.
Referring to the exhibit, which configuration will ensure that ICMP traffic is also translated?

A) config firewall central-snat-map edit 1 set protocol 1 next end
B) config firewall central-snat-map edit 1 set orig-addr "all" next end
C) config firewall ippool edit "secondry_ip" set arp-intf 'port1' next end
D) config firewall central-snat-map edit 1 unset protocol next end

4. You have deployed a FortiGate In NAT/Route mode as a secure as a web gateway with a few P-base authentication firewall policies. Your customer reports that some users now have different browsing permission =s from what is expected. All these users are browsing using internet Explorer through Desktop Connection to a Terminal Server. When you took at the Fortigate logs the username for the Terminal Server IP is not consistent.
Which action will correct this problem?

A) Change the FSSO polling mode to windows NetAPI
B) Install the TS/Citrix on the terminal server
C) Make sure Terminal Service is using the correct DNS ever.
D) Configure FSSO Advanced with LDAP integration

5. Click the Exhibit button.
Your customer is using dynamic routing to exchange the default route between two FortiGates using OSPFv2. The output of the get router info ospf neighbor command shows that the neighbor is up, but the default route does not appear in the routing neighbor shown below:

According to the exhibit, what is causing the problem?

A) FG2 is within the wrong OSPF area.
B) There is an OSPF interface network-type mismatch.
C) A prefix for the detail route is missing
D) OSPF requires the redistribution of connected networks.

質問と回答：