Purchase Fortinet : NSE8_811 Exam Materials and then pass exam easily

Fortinet NSE8_811 Exam Overview:

Fortinet NSE8_811 Exam Syllabus Topics:

Fortinet NSE 8 Written Exam (NSE8_811) Sample Questions:

1. You deploy a FortiGate device in a remote office based on the requirements shown below.
-- Due to company's security policy, management IP of your FortiGate is not allowed to access the Internet.
-- Apply Web Filtering, Antivirus, IPS and Application control to the protected subnet.
-- Be managed by a central FortiManager in the head office.
Which action will help to achieve the requirements?

A) Configure FortiGate to use FortiGuard Filtering Port 8888.
B) Configure a default route and make sure that the FortiGate device can pmg to service fortiguard net.
C) Configure the FortiGuard override server and use the IP address of the FortiManager
D) Configure the FortiGuard override server and use the IP address of service, fortiguard net.

2. In a FortiGate 5000 series, two FortiControllers are working as an SLBC cluster in a-p mode. The configuration shown below is applied.
config load-balance session-setup
set tcp-ingress enable
end
When statement is true on how new TCP sessions are handled by the Distributor Processor (DP)?

A) The new session added the DP session table is automatically deleted, if the traffic is denied by the processing worker.
B) A new session added m the DP session table remains in the table remain in the traffic is denied by the procession worker.
C) No new session is added is the DP session table until the processing worker accepts the traffic.
D) A new session added in the OP session table remains is the table only if traffic is traffic is accepted by the processing worker.

3. Click the Exhibit button.
Central NAT was configured on a FortiGate firewall. A sniffer shows ICMP packets out to a host on the Internet egresses with the port1 IP address instead of the virtual IP(VIP) that was configured.
Referring to the exhibit, which configuration will ensure that ICMP traffic is also translated?

A) config firewall central-snat-map edit 1 unset protocol next end
B) config firewall central-snat-map edit 1 set orig-addr "all" next end
C) config firewall central-snat-map edit 1 set protocol 1 next end
D) config firewall ippool edit "secondry_ip" set arp-intf 'port1' next end

4. A customer has a SCADA environmental control device that is triggering a false-positive IPS alert whenever the Web GUI of the device is accessed. You cannot create a functional custom IPS filter to exempt this behavior, and it appears that the device is so old that it does not have HTTPS support. You need to prevent the false positive IPS alerts from occurring.
In this scenario, which two actions will accomplish this task? (Choose two.)

A) Create a very specific firewall policy for that device IP address which does not perform IPS scanning.
B) Change the relevant firewall policies to use SSL certificate-inspection instead of SSL deep-inspection.
C) Reconfigure the FortiGate to operate in proxy-based inspection mode instead of flow-based.
D) Create a URL filter with the Exempt action for that device IP address.

5. Click to the Exhibit button.
You need to apply the security features below to the network shown in the exhibit.
-high grade DDoS protection
-Web security and load balancing for Server1 and Server2
-Solution must be PCI DSS compliant
-Enhanced security to DNS 1 and DNS 2

What are three solutions for this scenario? (Choose three.)

A) FortiDDoS between FG1 and FG2 and VDOMs
B) FortiADC for VDOM-A
C) FortiWeb for VDOM-A
D) FortiADC for VDOM-B
E) FortiDDoS between FG1 and FG2 and the Internet

Solutions: