最新のNSE8_813問題集で試験を準備する

A data center for example.com hosts several separate Web applications. Users authenticate with all of them by providing their Active Directory (AD) login credentials.
You do not have access to Example, Inc.'s AD server.
Your solution must do the following:
- provide single sign-on (SSO) for all protected Web applications
- prevent login brute forcing
- scan FTPS connections to the Web servers for exploits
- scan Webmail for OWASP Top 10 vulnerabilities such as session cookie
hijacking, XSS, and SQL injection attacks
Which solution meets these requirements?

• A. Apply FortiGate deep inspection to FTPS.
  It must forward FTPS, HTTP, and HTTPS to FortiWeb.
  Configure FortiWeb to query the AD server, and apply SSO for Web requests.
  FortiWeb must forward FTPS directly to the Web servers without inspection, but proxy HTTP/HTTPS and block Web attacks.
• B. Install FSSO Agent on servers.
  Configure FortiGate to inspect FTPS.
  FortiGate will forward FTPS, HTTP, and HTTPS to FortiWeb.
  FortiWeb must block Web attacks, then forward all traffic to the Web servers.
• C. Use FortiGate to authenticate and proxy HTTP/HTTPS; to verify credentials, FortiGate queries the AD server.
  Also configure FortiGate to scan FTPS before forwarding, and to mitigate SYN floods.
  Configure FortiWeb to block Web attacks.
• D. Deploy FortiDDos to block brute force attacks.
  Configure FortiGate to forward only FTPS, HTTP, and HTTPS to FortiWeb.
  Configure FortiWeb to query the AD server, and apply SSO for Web requests.
  Also configure it to scan FTPS and Web traffic, then forward allowed traffic to the Web servers.

Review the following FortiGate-6000 configuration excerpt:

Based on the configuration, which statement is correct regarding SNAT source port partitioning behavior?

• A. It is the default SNAT configuration and preserves active sessions when an FPC or FPM goes down.
• B. It dynamically distributes SNAT source ports to operating FPCs or FPMs.
• C. It equally distributes SNAT source ports across chassis slots.
• D. It statically distributes SNAT source ports to operating FPCs or FPMs.

A customer's cybersecurity department needs to implement security for the traffic between two VPCs in AWS, but these belong to different departments within the company. The company uses a single region for all their VPCs.
Which two actions will achieve this requirement while keeping separate management of each departments VPC? (Choose two.)

• A. Create a VPC with a FortiGate auto-scaling group with a Transit Gateway attached to the three VPC to force routing through the FortiGate cluster.
• B. Migrate all the instances to the same VPC and create IAM accounts for each department, then implement a new subnet for a FortiGate auto-scaling group and use routing tables to force the traffic through the FortiGate cluster.
• C. Create a transit VPC with a FortiGate HA cluster, connect to the other two using VPC peering, and use routing tables to force traffic through the FortiGate cluster.
• D. Create an IAM account for the cybersecurity department to manage both existing VPC, create a FortiGate HA Cluster on each VPC and IPSEC VPN to force traffic between the VPCs through the FortiGate clusters.

Refer to the exhibit.

The exhibit shows the topology a customer wants to implement using a flexible authentication scheme. Users connecting from trusted remote locations are authenticated using only their username/password when connecting to the SSLVPN FortiGate in the data center.
When connecting from the Untrusted Clients, users must authenticate using 2-factor authentication.
In this scenario, which RADIUS attribute can be used as a RADIUS policy selector on the FortiAuthenticator to accomplish this goal?

• A. Login-IP-Host
• B. Tunnel-Client-Auth-Id
• C. Framed-IP-Address
• D. Calling-Station-Id

Refer to the exhibit showing FortiGate configurations.

FortiManager VM high availability (HA) is not functioning as expected after being added to an existing deployment.
The administrator finds that VRRP HA mode is selected, but primary and secondary roles are greyed out in the GUI. The managed devices never show online when FMG-B becomes primary, but they will show online whenever the FMG-A becomes primary.
What change will correct HA functionality in this scenario?

• A. Unset the primary and secondary roles in the FortiManager CLI configuration so VRRP will decide who is primary.
• B. Change the FortiManager IP address on the managed FortiGate to 10.3.106.65.
• C. Make the monitored IP to match on both FortiManager devices.
• D. Change the priority of FMG-A to be numerically lower for higher preference.