2026년 현재 Fortinet NSE 8 Written Exam (NSE8_811)은 IT 인증 가운데서도 높은 관심을 받는 시험입니다. KoreaDumps의 NSE8_811 연습문제로 이 인기 자격에 도전해 보시기 바랍니다.

Fortinet NSE8_811 시험 개요:

Fortinet NSE8_811 시험 요강 주제:

Fortinet NSE8_811 시험 궁금증 해소 코너

최신 Fortinet Network Security Expert NSE8_811 무료샘플문제

문제 #1

A FortiGate with the default configuration shown below is deployed between two IP telephones. FortiGate receives the INVITE request shown in the exhibit from Phone A (internal) to Phone B (external).
NVITE sip:[email protected] SIP/2.0
Via: SIP/2.0/UDP 10.31.101.20:5060
From: PhoneA <sip:[email protected]>
To: PhoneB <sip:[email protected]>
Call-ID: [email protected]
CSeq: 1 INVITE
Contact: sip:[email protected]
v=0
o=PhoneA 5462346 332134 IN IP4 10.31.101.20
c=IN IP4 10.31.101.20
m=audio 49170 RTP 0 3
Which two statements are correct after the FortiGate receives the packet? (Choose two.)

A. NAT takes place at both the network and SIP application layers.
B. A pinhole is not required to accept traffic sent to the FortiGate WAN IP address.
C. A pinhole will be opened to accept traffic sent to the FortiGate WAN IP address.
D. NAT takes place only in the SIP application layer.

문제 #2

A FortOS devices is used for termination of VPNs for number of remote spoke VPN units (designated group A spokes) using a phase 1 main mode dial-up tunnel using pre-shared. Your company recently acquired another organization. You are asked establish VPN correctively for the newly acquired organization's sites which new devices will be provisioned (designated Group B spokes). Both exiting (Group A) and new (Group B) spoke units are dynamically addressed. You are asked to ensure that spokes from the acquired organization (Group B) have different access permission than your existing VPN spokes (Group A).
Which two solutions meet the represents for the new spoke group? (Choose two.)

A. Implement separate phase 1 dial-up aggressive mode tunnels with a distinct peer ID.
B. Implement a new phase 1 dial-up main mode tunnel with a different pre-shared key than the Group A
spokes.
C. Implement a new phase 1 dial-up main mode tunnel with pre-shared keys and XAuth.
D. Implement a new phase 1 dial-up main mode tunnel with certificate authentication.

문제 #3

Click the Exhibit button.
config system ha
set mode a-a
set group-id 1
set group-name main
set hb_dev port2 100
set session-pickup enable
end
You have configured an HA cluster with two FortiGates. You want to make sure that you are able to manage the individual cluster members directly using port3.
Referring to the exhibit, what are two ways to accomplish this task? (Choose two.)

A. Create a management VDOM and Disable the HA synchronization for this VDOM, assign ports to this VDOM, then configure specific IPs for ports on both cluster member.
B. Disable the sync feature on porl3: then configure specific IPs for ports on both cluster members.
C. Configure port3 to be a dedicated HA management interface, then configure specific IPs for port3 on both cluster members.
D. Allow administrative access in the HA heartbeat interfaces.

문제 #4

A customer has a SCADA environmental control device that is triggering a false-positive IPS alert whenever the Web GUI of the device is accessed. You cannot create a functional custom IPS filter to exempt this behavior, and it appears that the device is so old that it does not have HTTPS support. You need to prevent the false positive IPS alerts from occurring.
In this scenario, which two actions will accomplish this task? (Choose two.)

A. Create a URL filter with the Exempt action for that device IP address.
B. Reconfigure the FortiGate to operate in proxy-based inspection mode instead of flow-based.
C. Change the relevant firewall policies to use SSL certificate-inspection instead of SSL deep-inspection.
D. Create a very specific firewall policy for that device IP address which does not perform IPS scanning.

문제 #5

Exhibit
Click the Exhibit button.

A FortiGate is configured for a dial-up IPsec VPN to allow multiple remote FortiGates to connect to it.
However, FortiGates A and B have problems connecting to the VPN. Only one of them can be connected at a time. If site B tries to connect white site A is connected, site A is disconnected. The IKE real time debug shows the output in the exhibit when site A is disconnected.
Which configuration setting should be executed in the dial-up configuration to allow both VPNs to be connected at the same time?

A. set router-overlap allow
B. set single-source disable
C. set add-router enable
D. set enforce-unique-id disable

질문과 대답: