NSE8

NSE8 practice questions, page 2 of 3, with answer review and explanations.

Question 6

A company wants to protect against Denial of Service attacks and has launched a new project. They want to block the attacks that go above a certain threshold and for some others they are just trying to get a baseline of activity for those types of attacks so they are letting the traffic pass through without action. Given the following: - The interface to the Internet is on WAN1. - There is no requirement to specify which addresses are being protected or protected from. - The protection is to extend to all services. - The tcp_syn_flood attacks are to be recorded and blocked. - The udp_flood attacks are to be recorded but not blocked. - The tcp_syn_flood attacks threshold is to be changed from the default to 1000. The exhibit shows the current DoS-policy. Which policy will implement the project requirements? A) B) C) D)

  1. Option A
  2. Option B
  3. Option C
  4. Option D

Question 7

Your security department has requested that you implement the OpenSSL.TLS.Heartbeat.Information.Disclosure signature using an IPS sensor to scan traffic destined to the FortiGate. You must log all packets that attempt to exploit this vulnerability. Referring to the exhibit, which two configurations are required to accomplish this task? (Choose two.) A) B) C) D)

  1. Option A
  2. Option B
  3. Option C
  4. Option D

Question 8

Which command syntax would you use to configure the serial number of a FortiGate as its host name? A) B) C) D)

  1. Option A
  2. Option B
  3. Option C
  4. Option D

Question 9

Referring to the exhibit, which statement is true?

  1. The packet failed the HMAC validation.
  2. The packet did not match any of the local IPsec SAs.
  3. The packet was protected with an unsupported encryption algorithm.
  4. The IPsec negotiation failed because the SPI was unknown.

Question 10

You are asked to establish a VPN tunnel with a service provider using a third-party VPN device. The service provider has assigned subnet 30.30.30.0/24 for your outgoing traffic going towards the services hosted by the provider on network 20.20.20.0/24. You have multiple computers which will be accessing the remote services hosted by the service provider. Which three configuration components meet these requirements? (Choose three.)

  1. Configure an IP Pool of type Overload for range 30.30.30.10-30.30.30.10. Enable NAT on a policy from your LAN forwards the VPN tunnel and select that pool.
  2. Configure IPsec phase 2 proxy IDs for a source of 10.10.10.0/24 and destination of 20.20.20.0/24.
  3. Configure an IP Pool of Type One-to-One for range 30.30.30.10-30.30.30.10. Enable NAT on a policy from your LAN towards the VPN tunnel and select that pool.
  4. Configure a static route towards the VPN tunnel for 20.20.20.0/24.
  5. Configure IPsec phase 2 proxy IDs for a source of 30.30.30.0/24 and destination of 20.20.20.0/24.