Fortinet Network Security Expert 8 Written Exam (810) (NSE8_810) - Fortinet Exam Questions

Exhibit



You are working on an entry level model FortiGate that has been configured in flow based inspection mode with various settings optimized for performance. It appears that the man Internet Firewall policy using the antivirus profile labeled default. Your customer has found that some virus samples are not being caught by the FortiGate. Referring to the exhibit, what is causing the problem?

Exhibit edit 1



AN Exhibit EGR show firewall policy6 config firewall policy6 set name "internet-ipv6" set srcintf "port2" set dstintf "port1" set srcaddr "Ed00: acd5: 87a4: 890d: :10/128" set dataddr "all" set users "ngefuser" set profile-type group set profile-group "nse8-pfg" next end FGR show firu... puncy edit 1 config firewall policy set nane "Internet" set srcint! "port2" set dstint! "port1" set arcaddr "all" set dstaddr "all" set action accept set action accept set schedule "always" set schedule "always" set service "ALL" set service "ALL" set utm-status enable set utm-status enable set logtraffic all set faao disable set usere "nsefuser" get dinafilter-nrofile "nee8-wÉ-dns" set faso disable set users "nsefuser" set webfilter-profile "nse8-wf" set webfilter-profile "nse8-wf" set dnsfilter-profile "nae8-wE-dns" set profile-protocol-options "nse8-po" set 331-3sh-profile "certificate-inspection" set nat enable set nat enable next end Referring to the exhibit, which two statements are true? (Choose two.)

Exhibit



- Exhibit
Bof config router ospf set distribute-list-in incoming BOt config router access-list edit incoming config rule edit 1 set action deny set prefix 10.0.0.0 255.255.0.0 set exact-match disable next next end end end Bot get router info routing-table a11 Codes: K - kernel, © - connected, 5 - static, R - RIE, B - BGP O - OSPE, IA - OSPF inter ares N1 - OSPF NSA external type 1, N2 - CSPE NSSA external sype 2 21 - ospr external type 1, 22 - SP: external type 2 L - IS-IS, I1 - I3-IS level-1, 12 - IS-18 lerei-2, ia - IS-IS inter area

* - candidate default
3* D.0.0.0/0 [S/0] zia 104.0.169.1, xanl 10 0 c nr0 in aimo*ly connected. TM7 0 E2 10.10.LC.0/24 111C/10] via 10.0.0.1 HQ-VPN, 00:08:05 1C4. C.168.0/22 is directly connected, vani 172.16.1.0/24 is cirectly connected. IAN 192.168.17.0/24 (110/200] ria 10.0.0.1, HQ-ves, 00:08: 05 BO 1 diag snif pack any host 10.1(.10.35 aad icmp' 4
inter faces= [any]
fiLters=[host :0.10.10.35 and acmpl
32.079781 DMZ in 172.16.1.70 -> 10.10.10.35: imp: echo
33.679792 HQ-VPN out 172.16.1 →> 16.10.10.35:] icmp: echo
34.080219 DMB in 172.16.1.70 -> 10.10.10.35: icp: echo
request request request
35.CB0273 #Q-VPN out 10.0.0.2 -> 10.10.10.35: imp: echo
A VPN IPsec is connecting the headerquarters office (HQ) with a branch office OSPF is used to router between the offices. After deployment, a server with IP address 10.10.10.35 located on the DMZ network of the BO FortiGae was reported unreachable from hosts located on the LAN network of the same FortiGate. Referring to the exhibit, which statement is true?

You configure an outgoing firewall policy with a web filter for accessing the internet. The access to URL https// itacm.co and web belonging to the same category should be blocked. You notice that the Web server presents a certificate with CN=www acme.com. The www.it.acme site is as '' information Technology and the www.acme.com site is categorized as ''Business". Which statements is correct in this scenario?

Exhibit Referring to the exhibit, which command-line option for deep inspection SSL would have the
FortiGAte re=sign all untrusted self-signed certificates with the trusted Fortinet_CA_SSl certificate?