[May 29, 2026] Fortinet Dumps - Learn How To Deal With The (NSE8_812) Exam Anxiety
DEMO FREE BEFORE YOU BUY NSE8_812 DUMPS
NEW QUESTION # 33
Refer to the exhibits.
A customer wants to deploy 12 FortiAP 431F devices on high density conference center, but they do not currently have any PoE switches to connect them to. They want to be able to run them at full power while having network redundancy From the FortiSwitch models and sample retail prices shown in the exhibit, which build of materials would have the lowest cost, while fulfilling the customer's requirements?
- A. 2x FortiSwitch 248E-FPOE
- B. 1x FortiSwitch 248EFPOE
- C. 2x FortiSwitch 224E-POE
- D. 2x FortiSwitch 124E-FPOE
Answer: D
Explanation:
the access point will require about 24.5 W of power and the 124E-FPOE has a Capacity of about 370 meaning
25x12 = 300 so you left with about 70 W on the switch meaning you can still add two more access point on that switch.
NEW QUESTION # 34
Refer to the CLI configuration of an SSL inspection profile from a FortiGate device configured to protect a web server:
Based on the information shown, what is the expected behavior when an HTTP/2 request comes in?
- A. FortiGate will forward the traffic without modifying the ALPN header.
- B. FortiGate will rewrite the ALPN header to request HTTP/1.
- C. FortiGate will reject all HTTP/2 ALPN headers.
- D. FortiGate will strip the ALPN header and forward the traffic.
Answer: D
Explanation:
https://docs.fortinet.com/document/fortigate/7.0.0/new-features/710924/http-2-support-in-proxy-mode-ssl- inspection
NEW QUESTION # 35
Refer to the exhibit.
To facilitate a large-scale deployment of SD-WAN/ADVPN with FortiGate devices, you are tasked with configuring the FortiGate devices to support injecting of IKE routes on the ADVPN shortcut tunnels.
Which three commands must be added or changed to the FortiGate spoke config vpn ipsec phasei-interface options referenced in the exhibit for the VPN interface to enable this capability? (Choose three.)
- A. set mode-cfg-allow-client-selector enable
- B. set mode-cfg enable
- C. set ike-version 1
- D. set add-route enable
- E. set net-device disable
Answer: A,D,E
Explanation:
A is correct because net-device disable prevents the VPN interface from being added to the routing table as a connected route. This allows IKE routes to be injected instead. D is correct because add-route enable enables IKE route injection on the VPN interface. E is correct because mode-cfg-allow-client-selector enable allows the VPN interface to accept IKE routes from any peer that matches the phase 1 configuration. Reference: https://docs.fortinet.com/document/fortigate/7.0.1/administration-guide/490352/advpn https://docs.fortinet.com/document/fortigate/7.0.1/administration-guide/490352/advpn-configuration
NEW QUESTION # 36
A customer with a FortiDDoS 200F protecting their fibre optic internet connection from incoming traffic sees that all the traffic was dropped by the device even though they were not under a DoS attack. The traffic flow was restored after it was rebooted using the GUI. Which two options will prevent this situation in the future?
(Choose two)
- A. Replace with a FortiDDoS 1500F
- B. Change the Adaptive Mode.
- C. Create an HA setup with a second FortiDDoS 200F
- D. Move the internet connection from the SFP interfaces to the LC interfaces
Answer: A,C
Explanation:
* B is correct because creating an HA setup with a second FortiDDoS 200F will provide redundancy in case one of the devices fails. This will prevent all traffic from being dropped in the event of a failure.
* D is correct because the FortiDDoS 1500F has a larger throughput capacity than the FortiDDoS 200F.
This means that it will be less likely to drop traffic even under heavy load.
The other options are incorrect. Option A is incorrect because changing the Adaptive Mode will not prevent the device from dropping traffic. Option C is incorrect because moving the internet connection from the SFP interfaces to the LC interfaces will not change the throughput capacity of the device.
References:
* FortiDDoS 200F Datasheet | Fortinet Document Library
* FortiDDoS 1500F Datasheet | Fortinet Document Library
* High Availability (HA) on FortiDDoS | FortiDDoS / FortiOS 7.0.0 - Fortinet Document Library
NEW QUESTION # 37
Refer to the exhibits, which show a firewall policy configuration and a network topology.
An administrator has configured an inbound SSL inspection profile on a FortiGate device (FG-1) that is protecting a data center hosting multiple web pages-Given the scenario shown in the exhibits, which certificate will FortiGate use to handle requests to xyz.com?
- A. FortiGate will use the Fortinet_CA_Untrusted certificate for the untrusted connection,
- B. FortiGate will use the first certificate in the server-cert list-the abc.com certificate
- C. FortiGate will reject the connection since no certificate is defined.
- D. FortiGate will fall-back to the default Fortinet_CA_SSL certificate.
Answer: B
Explanation:
https://docs.fortinet.com/document/fortigate/7.4.1/administration-guide/850344/define-multiple-certificates-in- an-ssl-profile-in-replace-mode If there is no matched server certificate in the list, then the first server certificate in the list is used as a replacement.
NEW QUESTION # 38
You want to use the MTA adapter feature on FortiSandbox in an HA-Cluster. Which statement about this solution is true?
- A. The configuration of the MTA Adapter Local Interface is different than on port1.
- B. The MTA adapter mode is only detection mode.
- C. The MTA adapter is only available in the primary node.
- D. The configuration is different than on a standalone device.
Answer: C
Explanation:
The MTA adapter feature on FortiSandbox is a feature that allows FortiSandbox to act as a mail transfer agent (MTA) that can receive, inspect, and forward email messages from external sources. The MTA adapter feature can be used to integrate FortiSandbox with third-party email security solutions that do not support direct integration with FortiSandbox, such as Microsoft Exchange Server or Cisco Email Security Appliance (ESA). The MTA adapter feature can also be used to enhance email security by adding an additional layer of inspection and filtering before delivering email messages to the final destination. The MTA adapter feature can be enabled on FortiSandbox in an HA-Cluster, which is a configuration that allows two FortiSandbox units to synchronize their settings and data and provide high availability and load balancing for sandboxing services. However, one statement about this solution that is true is that the MTA adapter is only available in the primary node. This means that only one FortiSandbox unit in the HA-Cluster can act as an MTA and receive email messages from external sources, while the other unit acts as a backup node that can take over the MTA role if the primary node fails or loses connectivity. This also means that only one IP address or FQDN can be used to configure the external sources to send email messages to the FortiSandbox MTA, which is the IP address or FQDN of the primary node. References: https://docs.fortinet.com/document/fortisandbox/3.2.0/administration-guide/19662/mail-transfer-agent-mta https://docs.fortinet.com/document/fortisandbox/3.2.0/administration-guide/19662/high-availability-ha
NEW QUESTION # 39
Refer to the CLI output:
Given the information shown in the output, which two statements are correct? (Choose two.)
- A. An IP address that was previously used by an attacker will always be blocked
- B. Geographical IP policies are enabled and evaluated after local techniques.
- C. The IP Reputation feature has been manually updated
- D. Attackers can be blocked before they target the servers behind the FortiWeb.
- E. Reputation from blacklisted IP addresses from DHCP or PPPoE pools can be restored
Answer: D,E
Explanation:
The CLI output shown in the exhibit indicates that FortiWeb has enabled IP Reputation feature with local techniques enabled and geographical IP policies enabled after local techniques (set geoip-policy-order after- local). IP Reputation feature is a feature that allows FortiWeb to block or allow traffic based on the reputation score of IP addresses, which reflects their past malicious activities or behaviors. Local techniques are methods that FortiWeb uses to dynamically update its own blacklist based on its own detection of attacks or violations from IP addresses (such as signature matches, rate limiting, etc.). Geographical IP policies are rules that FortiWeb uses to block or allow traffic based on the geographical location of IP addresses (such as country, region, city, etc.). Therefore, based on the output, one correct statement is that attackers can be blocked before they target the servers behind the FortiWeb. This is because FortiWeb can use IP Reputation feature to block traffic from IP addresses that have a low reputation score or belong to a blacklisted location, which prevents them from reaching the servers and launching attacks. Another correct statement is that reputation from blacklisted IP addresses from DHCP or PPPoE pools can be restored. This is because FortiWeb can use local techniques to remove IP addresses from its own blacklist if they stop sending malicious traffic for a certain period of time (set local-techniques-expire-time), which allows them to regain their reputation and access the servers. This is useful for IP addresses that are dynamically assigned by DHCP or PPPoEand may change frequently. References: https://docs.fortinet.com/document/fortiweb/6.4.0/administration-guide/19662/ip- reputationhttps://docs.fortinet.com/document/fortiweb/6.4.0/administration-guide/19662/geographical-ip- policies
https://docs.fortinet.com/document/fortiweb/7.4.2/administration-guide/608374/ip-reputation-blocklisting- source-ips-with-poor-reputation Fortinet compiles a reputation for each public IP address. Clients will have poor reputations if they have been participating in attacks, willingly or otherwise. Because blacklisting innocent clients is equally undesirable, Fortinet also restores the reputations of clients that improve their behavior. This is crucial when an infected computer is cleaned, or in DHCP or PPPoE pools where an innocent client receives an IP address that was previously leased by an attacker.
NEW QUESTION # 40
You are troubleshooting a FortiMail Cloud service integrated with Office 365 where outgoing emails are not reaching the recipients' mail What are two possible reasons for this problem? (Choose two.)
- A. The FortiMail DKIM key was not set using the Auto Generation option.
- B. The FortiMail access control rule to relay from Office 365 servers FQDN is missing.
- C. The FortiMail access control rules to relay from Office 365 servers public IPs are missing.
- D. A Mail Flow connector from the Exchange Admin Center has not been set properly to the FortiMail Cloud FQDN.
Answer: C,D
Explanation:
https://docs.fortinet.com/document/fortimail/7.2.0/cookbook/963264/configuring-outbound-settings-in-office-
365
NEW QUESTION # 41
Refer to the exhibit.
A customer is trying to setup a Playbook automation using a FortiAnalyzer, FortiWeb and FortiGate. The intention is to have the FortiGate quarantine any source of SQL Injection detected by the FortiWeb. They got the automation stitch to trigger on the FortiGate when simulating an attack to their website, but the quarantine object was created with the IP 0.0.0.0. Referring to the configuration and logs in the exhibits, which two statements are true? (Choose two.)
- A. The FortiAnalyzer ADOM Type must be Fabric.
- B. To fix the issue the parameter for script on the Playbook configuration should be epip.
- C. To diagnose this issue, you need to use the command diagnose test application oftpd 22.
- D. FortiSOC Playbooks combining FortiWeb and FortiGate are not supported.
- E. The Group By option in the handler should be different to src, so src can be used on the Playbook configuration.
Answer: A,E
NEW QUESTION # 42
Refer to the exhibit.
You are deploying a FortiGate 6000F. The device should be directly connected to a switch. In the future, a new hardware module providing higher speed will be installed in the switch, and the connection to the FortiGate must be moved to this higher-speed port.
You must ensure that the initial FortiGate interface connected to the switch does not affect any other port when the new module is installed and the new port speed is defined.
How should the initial connection be made?
- A. Connect the switch on any interface between ports 1 to 4
- B. Connect the switch on any interface between ports 21 to 24
- C. Connect the switch on any interface between ports 25 to 28
- D. Connect the switch on any interface between ports 5 to 8.
Answer: A
Explanation:
The FortiGate 6000F has 24 1/10/25-Gbps SFP28 data network interfaces (1 to 24). These interfaces are divided into the following interface groups: 1 to 4, 5 to 8, 9 to 12, 13 to 16, 17 to 20, and 21 to 24. The ports 25 to 28 are 40/100-Gbps QSFP28 data network interfaces.
The initial connection should be made to any interface between ports 1 to 4. This is because the ports 21 to 24 are part of the same interface group, and changing the speed of one of these ports will affect the speeds of all of the ports in the group. The ports 5 to 8 are also part of the same interface group, so they should not be used for the initial connection.
The new hardware module that will be installed in the switch will provide higher speed ports. When this module is installed, the speed of the ports 21 to 24 will be increased. However, this will not affect the ports 1 to 4, because they are not part of the same interface group.
Therefore, the initial connection should be made to any interface between ports 1 to 4, in order to ensure that the FortiGate interface connected to the switch does not affect any other port when the new module is installed and the new port speed is defined.
Reference:
FortiGate 6000F Front Panel Interfaces: https://docs.fortinet.com/document/fortigate-6000/hardware/fortigate-6000f-system-guide/827055/front-panel-interfaces
NEW QUESTION # 43
Refer to the exhibit showing an SD-WAN configuration.
According to the exhibit, if an internal user pings 10.1.100.2 and 10.1.100.22 from subnet 172.16.205.0/24, which outgoing interfaces will be used?
- A. port1 and port15
- B. port16 and port1
- C. port1 and port1
- D. port16 and port15
Answer: B
Explanation:
According to the exhibit, the SD-WAN configuration has two rules: one for traffic to 10.1.100.0/24 subnet, and one for traffic to 10.1.100.16/28 subnet. The first rule uses the best quality strategy, which selects the SD-WAN member with the best measured quality based on performance SLA metrics. The second rule uses the manual strategy, which specifies port1 as the SD-WAN member to select. Therefore, if an internal user pings 10.1.100.2 and 10.1.100.22 from subnet 172.16.205.0/24, the outgoing interfaces will be port16 and port1 respectively, assuming that port16 has the best quality among the SD-WAN members. References: https://docs.fortinet.com/document/fortigate/6.2.14/cookbook/218559/configuring-the-sd-wan-interface
NEW QUESTION # 44
Refer to the exhibits.
A customer is looking for a solution to authenticate the clients connected to a hardware switch interface of a FortiGate 400E.
Referring to the exhibits, which two conditions allow authentication to the client devices before assigning an IP address? (Choose two.)
- A. FortiGate devices with NP6 and hardware switch interfaces cannot support 802.1X authentication.
- B. Devices connected directly to ports 3 and 4 can perform 802 1X authentication.
- C. Ports 3 and 4 can be part of different switch interfaces.
- D. Client devices must have 802 1X authentication enabled
Answer: B,D
Explanation:
The customer wants to deploy a solution to authenticate the clients connected to a hardware switch interface of a FortiGate 400E device. A hardware switch interface is an interface that combines multiple physical interfaces into one logical interface, allowing them to act as a single switch with one IP address and one set of security policies. The customer wants to use 802.1X authentication for this solution, which is a standard protocol for port-based network access control (PNAC) that authenticates clients based on their credentials before granting them access to network resources. One condition that allows authentication to the client devices before assigning an IP address is that devices connected directly to ports 3 and 4 can perform 802.1X authentication. This is because ports 3 and 4 are part of the hardware switch interface named "lan", which has an IP address of 10.10.10.254/24 and an inbound SSL inspection profile named "ssl-inspection". The inbound SSL inspection profile enables the FortiGate device to intercept and inspect SSL/TLS traffic from clients before forwarding it to servers, which allows it to apply security policies and features such as antivirus, web filtering, application control, etc. However, before performing SSL inspection, the FortiGate device needs to authenticate the clients using 802.1X authentication, which requires the clients to send their credentials (such as username and password) to the FortiGate device over a secure EAP (Extensible Authentication Protocol) channel. The FortiGate device then verifies the credentials with an authentication server (such as RADIUS or LDAP) and grants or denies access to the clients based on the authentication result. Therefore, devices connected directly to ports 3 and 4 can perform 802.1X authentication before assigning an IP address.
Another condition that allows authentication to the client devices before assigning an IP address is that client devices must have 802.1X authentication enabled. This is because 802.1X authentication is a mutual process that requires both the client devices and the FortiGate device to support and enable it. The client devices must have 802.1X authentication enabled in their network settings, which allows them to initiate the authentication process when they connect to the hardware switch interface of the FortiGate device. The client devices must also have an 802.1X supplicant software installed, which is a program that runs on the client devices and handles the communication with the FortiGate device using EAP messages. The client devices must also have a trusted certificate installed, which is used to verify the identity of the FortiGate device and establish a secure EAP channel. Therefore, client devices must have 802.1X authentication enabled before assigning an IP address. References: https://docs.fortinet.com/document/fortigate/7.0.0/administration-guide/19662/hardware- switch-interfaces https://docs.fortinet.com/document/fortigate/7.0.0/administration-guide/19662/802-1x- authentication
https://docs.fortinet.com/document/fortigate/7.2.0/new-features/959502/support-802-1x-on-virtual-switch-for- certain-np6-platforms
NEW QUESTION # 45
Refer to the exhibit.
An HTTPS access proxy is configured to demonstrate its function as a reverse proxy on behalf of the web server it is protecting. It verifies user identity, device identity, and trust context, before granting access to the protected source. It is assumed that the FortiGate EMS fabric connector has already been successfully connected.
You need to ensure that ZTNA access through the FortiGate will redirect users to the FortiAuthenticator to perform username/password and multifactor authentication to validate access prior to accessing resources behind the FortiGate.
In this scenario, which two further steps need to be taken on the FortiGate? (Choose two.)
- A. Create a firewall rule that allows access from the remote endpoint to the resources behind the FortiGate.
- B. Create an authentication rule that sets the sso-auth-method to the FortiAuthenticator.
- C. Create an authentication scheme with the "method" as SAML.
- D. Create a SAML user/server object referring to the FortiAuthenticator.
Answer: C,D
NEW QUESTION # 46
Refer to the exhibit.
You need to create a base SD-WAN configuration that includes SD-WAN rules and Performance SLAs for spoke sites with various connectivity types. It needs to be done in a way that can be easily applied to new sites with a minimum amount of change. How should you create the SD-WAN zones?
- A. With members without interface assignments
- B. With members and assign interfaces but do not specify a gateway
- C. With members and assign overlay interfaces
- D. With no members configured
Answer: C
NEW QUESTION # 47
You have configured a Site-to-Site IPsec VPN tunnel between a FortiGate and a third-party device but notice that one of the error counters on the tunnel interface keeps increasing.
Which two configuration options can resolve this problem? (Choose two.)
- A. Adjust the MTU of the physical interface to which the IPsec tunnel is bound.
- B. Enable DF-bit honoring in the global settings.
- C. Adjust the MTU of the IPsec interface.
- D. Enable Forward Error Correction (FEC) on the VPN interface for egress traffic.
Answer: B,C
NEW QUESTION # 48
You are running a diagnose command continuously as traffic flows through a platform with NP6 and you obtain the following output:
Given the information shown in the output, which two statements are true? (Choose two.)
- A. Enabling bandwidth control between the ISF and the NP will change the output
- B. Host-shortcut mode is enabled.
- C. The output is showing a packet descriptor queue accumulated counter
- D. Enable HPE shaper for the NP6 will change the output
- E. There are packet drops at the XAUI.
Answer: C,E
Explanation:
The diagnose command shown in the output is used to display information about NP6 packet descriptor queues. The output shows that there are 16 NP6 units in total, and each unit has four XAUI ports (XA0-XA3). The output also shows that there are some non-zero values in the columns PDQ ACCU (packet descriptor queue accumulated counter) and PDQ DROP (packet descriptor queue drop counter). These values indicate that there are some packet descriptor queues that have reached their maximum capacity and have dropped some packets at the XAUI ports. This could be caused by congestion or misconfiguration of the XAUI ports or the ISF (Internal Switch Fabric). Reference: https://docs.fortinet.com/document/fortigate/7.0.0/cli-reference/19662/diagnose-np6-pdq
NEW QUESTION # 49
Wh.ch feature must you enable on the BGP neighbors to accomplish this goal?
- A. Synchronization
- B. Graceful-restart
- C. Soft-reconfiguration
- D. Deterministic-med
Answer: B
Explanation:
Graceful-restart is a feature that allows BGP neighbors to maintain their routing information during a BGP restart or failover event, without disrupting traffic forwarding or causing route flaps. Graceful-restart works by allowing a BGP speaker (the restarting router) to notify its neighbors (the helper routers) that it is about to restart or failover, and request them to preserve their routing information and forwarding state for a certain period of time (the restart time). The helper routers then mark the routes learned from the restarting router as stale, but keep them in their routing table and continue forwarding traffic based on them until they receive an end-of-RIB marker from the restarting router or until the restart time expires. This way, graceful-restart can minimize traffic disruption and routing instability during a BGP restart or failover event. Reference: https://docs.fortinet.com/document/fortigate/7.0.0/cookbook/19662/bgp-graceful-restart
NEW QUESTION # 50
Refer to the exhibit showing FortiGate configurations
FortiManager VM high availability (HA) is not functioning as expected after being added to an existing deployment.
The administrator finds that VRRP HA mode is selected, but primary and secondary roles are greyed out in the GUI The managed devices never show online when FMG-B becomes primary, but they will show online whenever the FMG-A becomes primary.
What change will correct HA functionality in this scenario?
- A. Make the monitored IP to match on both FortiManager devices.
- B. Change the priority of FMG-A to be numerically lower for higher preference
- C. Unset the primary and secondary roles in the FortiManager CLI configuration so VRRP will decide who is primary.
- D. Change the FortiManager IP address on the managed FortiGate to 10.3.106.65.
Answer: A
Explanation:
B is correct because the monitored IP must match on both FortiManager devices for HA to function properly. This is explained in the FortiManager Administration Guide under High Availability > Configuring HA options > Configuring HA options using the GUI. Reference: https://docs.fortinet.com/document/fortimanager/7.4.0/administration-guide/568591/high-availability https://docs.fortinet.com/document/fortimanager/7.4.0/administration-guide/568591/high-availability/568592/configuring-ha-options
NEW QUESTION # 51
Refer to the exhibits.
The exhibits show a FortiGate network topology and the output of the status of high availability on the FortiGate.
Given this information, which statement is correct?
- A. The cluster members are on the same network and the IP addresses were statically assigned.
- B. FGVMEVLQOG33WM3D and FGVMEVGCJNHFYI4A share a virtual MAC address.
- C. The cluster mode can support a maximum of four (4) FortiGate VMs
- D. The ethertype values of the HA packets are 0x8890, 0x8891, and 0x8892
Answer: B
Explanation:
The output of the status of high availability on the FortiGate shows that the cluster mode is active-passive, which means that only one FortiGate unit is active at a time, while the other unit is in standby mode. The active unit handles all traffic and also sends HA heartbeat packets to monitor the standby unit. The standby unit becomes active if it stops receiving heartbeat packets from the active unit, or if it receives a higher priority from another cluster unit. In active-passive mode, all cluster units share a virtual MAC address for each interface, which is used as the source MAC address for all packets forwarded by the cluster. References: https://docs.fortinet.com/document/fortigate/6.4.0/cookbook/103439/high-availability-with-two-fortigates
NEW QUESTION # 52
Refer to the exhibit.
The exhibit shows the topology a customer wants to implement using a flexible authentication scheme. Users connecting from trusted remote locations are authenticated using only their username/password when connecting to the SSLVPN FortiGate in the data center.
When connecting from the Untrusted Clients, users must authenticate using 2-factor authentication.
In this scenario, which RADIUS attribute can be used as a RADIUS policy selector on the FortiAuthenticator to accomplish this goal?
- A. Login-IP-Host
- B. Calling-Station-Id
- C. Framed-IP-Address
- D. Tunnel-Client-Auth-Id
Answer: D
NEW QUESTION # 53
Refer to the exhibit showing a FortiSOAR playbook.
You are investigating a suspicious e-mail alert on FortiSOAR, and after reviewing the executed playbook, you can see that it requires intervention.
What should be your next step?
- A. Run the Mark Drive by Download playbook action
- B. Click on the notification icon on FortiSOAR GUI and run the pending input action
- C. Go to the Incident Response tasks dashboard and run the pending actions
- D. Reply to the e-mail with the requested Playbook action
Answer: C
Explanation:
The exhibited playbook requires intervention, which means that the playbook has reached a point where it needs a human operator to take action. The next step should be to go to the Incident Response tasks dashboard and run the pending actions. This will allow you to see the pending actions that need to be taken and to take those actions.
The other options are not correct. Option B will only show you the notification icon, but it will not allow you to run the pending input action. Option C will run the Mark Drive by Download playbook action, but this is not the correct action to take in this case. Option D is not a valid option.
Here are some additional details about pending actions in FortiSOAR:
Pending actions are actions that need to be taken by a human operator.
Pending actions are displayed in the Incident Response tasks dashboard.
Pending actions can be run by clicking on the action in the dashboard.
NEW QUESTION # 54
You are troubleshooting a FortiMail Cloud service integrated with Office 365 where outgoing emails are not reaching the recipients' mail What are two possible reasons for this problem? (Choose two.)
- A. The FortiMail DKIM key was not set using the Auto Generation option.
- B. The FortiMail access control rule to relay from Office 365 servers FQDN is missing.
- C. The FortiMail access control rules to relay from Office 365 servers public IPs are missing.
- D. A Mail Flow connector from the Exchange Admin Center has not been set properly to the FortiMail Cloud FQDN.
Answer: B,D
Explanation:
a) The FortiMail access control rule to relay from Office 365 servers FQDN is missing.
If the access control rule to relay from Office 365 servers FQDN is missing, then FortiMail will not be able to send emails to Office 365. This is because the access control rule specifies which IP addresses or domains are allowed to relay emails through FortiMail.
b) A Mail Flow connector from the Exchange Admin Center has not been set properly to the FortiMail Cloud FQDN.
If the Mail Flow connector from the Exchange Admin Center is not set properly to the FortiMail Cloud FQDN, then Office 365 will not be able to send emails to FortiMail. This is because the Mail Flow connector specifies which SMTP server is used to send emails to external recipients.
NEW QUESTION # 55
Refer to the exhibit containing the configuration snippets from the FortiGate. Customer requirements:
* SSLVPN Portal must be accessible on standard HTTPS port (TCP/443)
* Public IP address (129.11.1.100) is assigned to portl
* Datacenter.acmecorp.com resolves to the public IP address assigned to portl The customer has a Let's Encrypt certificate that is going to expire soon and it reports that subsequent attempts to renew that certificate are failing.
Reviewing the requirement and the exhibit, which configuration change below will resolve this issue?
- A.
- B.
- C.
- D.
Answer: B
Explanation:
https://docs.fortinet.com/document/fortigate/7.4.1/administration-guide/822087/automatically-provision-a- certificate
NEW QUESTION # 56
Refer to the exhibit.
Given the exhibit, which two statements about FortiGate FGSP HA cluster behavior are correct? (Choose two.)
- A. You can run FortiGate Virtual Router Redundancy Protocol (VRRP) high availability in addition to FGSP simultaneously.
- B. You can selectively synchronize only specific sessions between FGSP cluster members.
- C. Cluster members will upgrade one at a time and failover during firmware upgrades.
- D. Session synchronization occurs over Layer 3 by default, and if unavailable it will then try Layer 2.
Answer: A,D
NEW QUESTION # 57
......
Latest Fortinet NSE8_812 Dumps with Test Engine and PDF: https://www.test4cram.com/NSE8_812_real-exam-dumps.html
Now, get the NEWEST NSE8_812 dumps in Test Engine from: https://drive.google.com/open?id=1KIgWdGv-a7pkBJ1vDYAudNvcREHeydqa