Free NSE8-812 Fortinet NSE8-812 Practice Test Question - Page 2

Question 4 (Topic 1)

You are migrating the branches of a customer to FortiGate devices. They require independent routing tables on the LAN side of the network. After reviewing the design, you notice the firewall will have many BGP sessions as you have two data centers (DC) and two ISPs per DC while each branch is using at least 10 internal segments. Based on this scenario, what would you suggest as the more efficient solution, considering that in the future the number of internal segments, DCs or internet links per DC will increase?

Select an option, then click Submit answer.

○ No change in design is needed as even small FortiGate devices have a large memory capacity
○ Acquire a FortiGate model with more capacity, considering the next 5 years growth
○ Implement network-id, neighbor-group and increase the advertisement-interval
○ Redesign the SD-WAN deployment to only use a single VPN tunnel and segment traffic using VRFs on BGP

Question 5 (Topic 1)

Refer to the exhibit. A customer wants FortiClient EMS configured to deploy to 1500 endpoints The deployment will be integrated with FortiOS and there is an Active Directory server. Given the configuration shown in the exhibit, which two statements about the installation are correct? (Choose two.)

Select an option, then click Submit answer.

○ If no client update time is specified on EMS, the user will be able to choose the time of installation if they wish to delay.
○ A client can be eligible for multiple enabled configurations on the EMS server, and one will be chosen based on first priority.
○ You can only deploy initial installations to Windows clients.
○ You must use Standard or Enterprise SQL Server rather than the included SQL Server Express.
○ The Windows clients only require “File and Printer Sharing” allowed and the rest is handled by Active Directory group policy.

Reference / correct answer:

A client can be eligible for multiple enabled configurations on the EMS server, and one will be chosen based on first priority.

Most accepted answer: B. A client can be eligible for multiple enabled configurations on the EMS server, and one will be chosen based on first priority.

Community votes: B=2, C=2

B: If an endpoint is eligible for multiple enabled configurations, EMS applies the configuration with the first priority level to the endpoint. wrote on Home FortiClient 7.2.4 EMS Administration Guide Managing deployment configuration priority levels upvoted 1 times

Selected Answer: BC B: If an endpoint is eligible for multiple enabled configurations, EMS applies the configuration with the first priority level to the endpoint. C: When using an AD server, you can deploy an initial installation of FortiClient (Windows) to endpoints, but you cannot deploy an initial installation of FortiClient (macOS) upvoted 2 times

Selected Answer: BC https://docs.fortinet.com/document/forticlient/7.0.7/ems-administration-guide/278884/deployment-installers https://docs.fortinet.com/document/forticlient/7.0.7/ems-administration-guide/374506/deploying-forticlient-software-to-endpoints upvoted 2 times

A and E upvoted 1 times

Question 6 (Topic 1)

You have configured a Site-to-Site IPsec VPN tunnel between a FortiGate and a third-party device but notice that one of the error counters on the tunnel interface keeps increasing. Which two configuration options can resolve this problem? (Choose two.)

Select an option, then click Submit answer.

○ Enable Forward Error Correction (FEC) on the VPN interface for egress traffic.
○ Enable DF-bit honoring in the global settings.
○ Adjust the MTU of the physical interface to which the IPsec tunnel is bound.
○ Adjust the MTU of the IPsec interface.

Reference / correct answer:

Adjust the MTU of the IPsec interface.

Most accepted answer: D. Adjust the MTU of the IPsec interface.

Community votes: A=1, B=1, C=1, D=3

Selected Answer: CD The growing error counter is typical of MTU/fragmentation issues on IPsec tunnels. Fix by tuning MTU: C – Lower/adjust the MTU on the physical interface carrying the IPsec traffic. D – Lower/adjust the MTU on the IPsec interface itself (enable MTU override and set an appropriate value). (Forward Error Correction and DF-bit honoring won’t address this counter directly.) C and D directly fix the MTU mismatch by lowering the packet size on the physical and IPsec interfaces to account for encryption overhead, eliminating the cause of TX errors. B (DF-bit honoring) only helps if Path MTU Discovery works end-to-end, which often fails due to blocked ICMP — so it’s less reliable. upvoted 2 times

Selected Answer: BD A can't be correct as the tunnel is to a third party device upvoted 1 times

Selected Answer: AD Not sure on the missing answer. A: FEC can help reconstruct the lost data. B: the DF bit enabled would make it so if the MTU of the packets were bigger than the physical interface MTU then it would drop, so this is better to be disabled. C: Adjusting the MTU of the physical interface effects all traffic through that interface. D: Adjusting the MTU of the IPsec would allow the encrypted payload to fit into the size of the interfaces MTU, preventing the drop of packets. upvoted 1 times

original question is with choose three option + missin here an additional answer upvoted 1 times

Free NSE8-812 – Fortinet NSE8-812 Practice Test Question