Fortinet NSE8_812 Exam - Topic 4 Question 37 Discussion

Actual exam question for Fortinet's NSE8_812 exam

Question #: 37
Topic #: 4

[All NSE8_812 Questions]

Refer to the exhibit.

Given the exhibit, which two statements about FortiGate FGSP HA cluster behavior are correct? (Choose two.)

AYou can run FortiGate Virtual Router Redundancy Protocol (VRRP) high availability in addition to FGSP simultaneously.

BSession synchronization occurs over Layer 3 by default, and if unavailable it will then try Layer 2.

CYou can selectively synchronize only specific sessions between FGSP cluster members.

DCluster members will upgrade one at a time and failover during firmware upgrades.

Show Suggested Answer

Suggested Answer: B, D

Bis correct because the OCSP check of the certificate can be combined with a certificate revocation list (CRL). This means that the FortiGate will check the OCSP server to see if the certificate has been revoked, and it will also check the CRL to see if the certificate has been revoked.

Dis correct because if the OCSP server is unreachable, authentication will succeed if the certificate matches the CA. This is because the FortiGate will fall back to using the CRL if the OCSP server is unreachable.

The other options are incorrect. Option A is incorrect because OCSP checks can go to other OCSP servers, not just the FortiAuthenticator. Option C is incorrect because OCSP certificate responses can be cached by the FortiGate.

References:

Configuring SSL VPN authentication using digital certificates | FortiGate / FortiOS 7.2.0 - Fortinet Document Library

Online Certificate Status Protocol (OCSP) | FortiGate / FortiOS 7.2.0 - Fortinet Document Library

Certificate Revocation Lists (CRLs) | FortiGate / FortiOS 7.2.0 - Fortinet Document Library

by Theodora at Oct 19, 2024, 07:04 AM

Limited Time Offer

25%

Off

Get Premium NSE8_812 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Tracie

4 months ago

C seems off, I thought all sessions had to sync by default.

upvoted 0 times

...

Nikita

4 months ago

D is true, I've seen it happen during upgrades.

upvoted 0 times

...

Reita

4 months ago

Wait, can you really selectively sync sessions? Sounds odd.

upvoted 0 times

...

Harris

4 months ago

I think A is misleading, FGSP and VRRP can't run together.

upvoted 0 times

...

Kate

5 months ago

B is definitely correct, session sync over Layer 3 is standard.

upvoted 0 times

...

Iesha

5 months ago

I’m pretty confident that cluster members upgrade one at a time, but I can't remember if they failover during that process. I hope I got that right!

upvoted 0 times

...

Justine

5 months ago

I think option C sounds familiar, but I’m not entirely sure if selective synchronization is a feature of FGSP. It’s a bit hazy for me.

upvoted 0 times

...

Esteban

5 months ago

I feel like session synchronization is important, but I can't recall if it defaults to Layer 3 or Layer 2. I hope I picked the right one!

upvoted 0 times

...

Roslyn

5 months ago

I remember something about VRRP and FGSP, but I'm not sure if they can run together. I think I might have seen a question like this in practice.

upvoted 0 times

...

Judy

5 months ago

I've worked with FortiGate before, so I think I've got a good handle on this. I'll just need to double-check my understanding.

upvoted 0 times

...

Darci

5 months ago

The exhibit gives a good overview, but I'm not sure I fully understand the nuances of how the FGSP cluster behaves. I'll need to read the options closely.

upvoted 0 times

...

Melissa

5 months ago

Okay, let's see. I remember something about VRRP and session synchronization, so I'll focus on those areas.

upvoted 0 times

...

Mattie

5 months ago

Hmm, I'm not too familiar with FortiGate FGSP HA cluster behavior. I'll need to think this through carefully.

upvoted 0 times

...

Adell

5 months ago

This question looks pretty straightforward. I think I can handle it.

upvoted 0 times

...

Hector

10 months ago

Hmm, I wonder if the answer key includes a secret 'E' option that says 'All of the above, plus a dance routine to distract the enemy during failover.' *chuckles* Gotta be ready for anything in this industry, you know?

upvoted 0 times

Felicitas

9 months ago

C) Yeah, you never know what surprises might come up in the world of networking!

upvoted 0 times

...

Loren

9 months ago

B) I wish there was an option like that, it would make HA clusters a lot more fun.

upvoted 0 times

...

Merissa

10 months ago

A) Haha, that would definitely make things more interesting during failover!

upvoted 0 times

...

Tracey

11 months ago

A and C seem like the right answers. I mean, who wouldn't want to run VRRP and FGSP together? The more redundancy, the better, right? *laughs* Though I'm not sure I'd want to be the one upgrading those clusters!

upvoted 0 times

Lorrie

10 months ago

Lanie: I can only imagine the stress of upgrading one cluster member at a time and hoping for a smooth failover.

upvoted 0 times

...

Lanie

10 months ago

User 2: Definitely, the more redundancy, the better. But upgrading those clusters does sound like a daunting task.

upvoted 0 times

...

Georgiann

10 months ago

User 1: Yeah, I agree. Having both VRRP and FGSP running together sounds like a solid plan.

upvoted 0 times

...

Maryann

11 months ago

B is definitely wrong. Session synchronization over Layer 2? That's just asking for trouble. Layer 3 is the way to go.

upvoted 0 times

...

Chana

11 months ago

Option D sounds like the way to go. Upgrading one at a time and failover during firmware upgrades sounds like it would minimize downtime. Very practical!

upvoted 0 times

Janey

10 months ago

Definitely, having a failover plan in place is key for maintaining continuous network availability.

upvoted 0 times

...

Ryan

10 months ago

I agree, it's important to have a smooth upgrade process to avoid disruptions.

upvoted 0 times

...

Holley

10 months ago

Yes, minimizing downtime is crucial for network reliability.

upvoted 0 times

...

Lenna

11 months ago

Option D sounds like the way to go. Upgrading one at a time and failover during firmware upgrades sounds like it would minimize downtime. Very practical!

upvoted 0 times

...