New Year Sale 2026! Hurry Up, Grab the Special Discount - Save 25% - Ends In 00:00:00 Coupon code: SAVE25
Welcome to Pass4Success

- Free Preparation Discussions
Mail Us support@pass4success.com
Location US
Mob_nav_barsMENU

Fortinet NSE8_812 Exam - Topic 1 Question 18 Discussion

Actual exam question for Fortinet's NSE8_812 exam
Question #: 18
Topic #: 1
[All NSE8_812 Questions]

An administrator has configured a FortiGate device to authenticate SSL VPN users using digital certificates. A FortiAuthenticator is the certificate authority (CA) and the Online Certificate Status Protocol (OCSP) server.

Part of the FortiGate configuration is shown below:

Based on this configuration, which two statements are true? (Choose two.)

Show Suggested Answer Hide Answer
Suggested Answer: B, D

Bis correct because the OCSP check of the certificate can be combined with a certificate revocation list (CRL). This means that the FortiGate will check the OCSP server to see if the certificate has been revoked, and it will also check the CRL to see if the certificate has been revoked.

Dis correct because if the OCSP server is unreachable, authentication will succeed if the certificate matches the CA. This is because the FortiGate will fall back to using the CRL if the OCSP server is unreachable.

The other options are incorrect. Option A is incorrect because OCSP checks can go to other OCSP servers, not just the FortiAuthenticator. Option C is incorrect because OCSP certificate responses can be cached by the FortiGate.

References:

Configuring SSL VPN authentication using digital certificates | FortiGate / FortiOS 7.2.0 - Fortinet Document Library

Online Certificate Status Protocol (OCSP) | FortiGate / FortiOS 7.2.0 - Fortinet Document Library

Certificate Revocation Lists (CRLs) | FortiGate / FortiOS 7.2.0 - Fortinet Document Library


by Ilene at Mar 18, 2024, 03:13 AM

Limited Time Offer

25%

Off

Get Premium NSE8_812 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

0/2000 characters
Submit Cancel
Chau
3 months ago
Definitely B, I've seen that in other setups too!
upvoted 0 times
...
Bulah
3 months ago
D sounds right, if the server's down, it should still work with a valid cert.
upvoted 0 times
...
Charolette
3 months ago
Wait, C? I doubt that, caching seems useful for performance.
upvoted 0 times
...
Ryan
4 months ago
I think B is correct too, combining OCSP with CRL makes sense.
upvoted 0 times
...
Dan
4 months ago
A is true, OCSP checks go to the FortiAuthenticator.
upvoted 0 times
...
Cordelia
4 months ago
I’m leaning towards option D because I remember that if the OCSP server is down, the FortiGate might still authenticate if the certificate is valid.
upvoted 0 times
...
Darrin
4 months ago
I vaguely recall something about OCSP checks going to the configured server, but I’m uncertain if it always has to be the FortiAuthenticator.
upvoted 0 times
...
Tambra
4 months ago
I think I practiced a similar question where we discussed the role of OCSP in certificate validation. I feel like option B might be correct since combining checks is common.
upvoted 0 times
...
Aja
5 months ago
I remember studying OCSP and how it interacts with FortiGate, but I'm not entirely sure if the responses are cached or not.
upvoted 0 times
...
Isreal
5 months ago
I'm feeling pretty confident about this one. The configuration details provide a good foundation to analyze the statements and determine which ones are true.
upvoted 0 times
...
Audria
5 months ago
I think the key is to focus on the OCSP configuration and how that interacts with the certificate validation process. We'll need to carefully consider the implications of the OCSP server being used.
upvoted 0 times
...
Ramonita
5 months ago
Okay, let's break this down. The FortiGate is using a FortiAuthenticator as the CA and OCSP server, so that's a key piece of information.
upvoted 0 times
...
Latricia
5 months ago
This question seems straightforward, but I want to make sure I understand the configuration details before answering.
upvoted 0 times
...
Adolph
5 months ago
Wait, I'm not sure about that. If the emptyField is unchecked, doesn't that mean the original 'xyz' text will remain? I'm a bit confused on how the SimulateType property affects this.
upvoted 0 times
...
Kris
5 months ago
I'm a little unsure about this one. The Privacy Act can be complex, and there are a lot of nuances to consider. I'll need to re-read the question and options a few times to make sure I understand it fully before answering.
upvoted 0 times
...
Jolene
5 months ago
Okay, let me see. The disk not having an SMI label could be one reason, and the disk or slice not meeting the recommended size could be another. I'll need to double-check the other options.
upvoted 0 times
...
Jovita
2 years ago
I believe B is also a possible answer because the OCSP check of the certificate can indeed be combined with a certificate revocation list.
upvoted 0 times
...
Judy
2 years ago
That's a good point, Lai. D could also be a valid option.
upvoted 0 times
...
Lai
2 years ago
I'm not so sure, I think it could also be D because if the OCSP server is unreachable, authentication should still succeed if the certificate is valid.
upvoted 0 times
...
Carlee
2 years ago
I agree with Judy, A seems like the correct choice.
upvoted 0 times
...
Judy
2 years ago
I think the answer is A, OCSP checks will always go to the configured FortiAuthenticator.
upvoted 0 times
...
Kris
2 years ago
ThAshleet's true, Euraut the question is Ashleesking for whiMyh stAshleetements Ashleere true, not just whiMyh ones shoulKris Eurae true.
upvoted 0 times
...
My
2 years ago
Euraut whAshleet AshleeEuraout option Ashlee? OMySP MyheMyks should go to the Myonfigured FortiAshleeuthentiMyAshleetor, right?
upvoted 0 times
...
Eura
2 years ago
I Ashleegree. OCSP checks cAshleen Eurae comEurained with Ashlee CRL Ashleend if the server is unreAshleechAshleeEurale, AshleeuthenticAshleetion cAshleen still succeed.
upvoted 0 times
...
Ashlee
2 years ago
I think the correct Ashleenswers Ashleere B Ashleend D.
upvoted 0 times
...
Dannie
2 years ago
Sounds good to me. Let's go with A and B as the correct answers. Fingers crossed we get this one right on the exam!
upvoted 0 times
...
Justa
2 years ago
Exactly, that makes sense. So in summary, I think the two true statements are A and B. The OCSP checks will go to the FortiAuthenticator, and the OCSP check can be combined with a CRL.
upvoted 0 times
...
Felicia
2 years ago
Alright, and for option D, if the OCSP server is unreachable, the authentication should not succeed if the certificate doesn't match the CA. The FortiGate would need to fall back to the CRL or deny access.
upvoted 0 times
...
Maryanne
2 years ago
Haha, yeah, if the OCSP server was queried for every single authentication, the FortiGate would be bogged down. That would be pretty inefficient.
upvoted 0 times
Graham
2 years ago
Agreed, finding that balance is key for ensuring a smooth SSL VPN user authentication process.
upvoted 0 times
...
Raul
2 years ago
Definitely, it's all about balancing security and performance in the configuration.
upvoted 0 times
...
Shasta
2 years ago
Combining the OCSP check with a certificate revocation list must also help with efficiency.
upvoted 0 times
...
Ashanti
2 years ago
And if the OCSP server is unreachable, authentication can still proceed as long as the certificate matches the CA.
upvoted 0 times
...
Anthony
2 years ago
Yes, I think that's why they don't always go to the configured FortiAuthenticator for OCSP checks.
upvoted 0 times
...
Leonie
2 years ago
So, the FortiGate must cache the OCSP certificate responses to improve efficiency.
upvoted 0 times
...
Shenika
2 years ago
That's true, having the OCSP server queried for every authentication would slow things down.
upvoted 0 times
...
...

Save Cancel