Exam NSE8_812 topic 1 question 30 discussion

Actual exam question from Fortinet's NSE8_812

Question #: 30
Topic #: 1

Refer to the exhibit, which shows the high availability configuration for the FortiAuthenticator (FAC1).

GUI Access -

Based on this information, which statement is true about the next FortiAuthenticator (FAC2) member that will join an HA cluster with this FortiAuthenticator (FAC1)?

A. FAC2 can only process requests when FAC1 fails.
B. FAC2 can have its HA interface on a different network than FAC1
C. The FortiToken license will need to be installed on the FAC2
D. FSSO sessions from FAC1 will be synchronized to FAC2

Show Suggested Answer

Suggested Answer: B 🗳️

by pplee_sh at Aug. 21, 2023, 4:07 p.m.

Comments

Submit Cancel

re_j0hn

1 year ago

Selected Answer: B

Answer is B. A is wrong because the setup is not Active/Passive HA. C is wrong because FortiToken is synced. D is wrong because FSSO session is not synced.

upvoted 3 times

...

pitz

1 year, 4 months ago

Selected Answer: B

Other features, such as FSSO cannot be synchronized between devices. https://docs.fortinet.com/document/fortiauthenticator/6.5.3/administration-guide/122076/high-availability

upvoted 2 times

...

ama6

1 year, 4 months ago

B is correct FortiAuthenticator VMs used in a HA cluster each require a license. Each license is tied to a specific IP address. In an HA cluster, all interface IP addresses are the same on the units, expect for the HA interface. Request each license backed on either the unique IP address of the unit's HA interface or the IP address of a non-HA interface which is the same on both units. https://docs.fortinet.com/document/fortiauthenticator/6.5.3/administration-guide/122076/high-availability#Standalo

upvoted 1 times

...

Viewable8041

1 year, 5 months ago

Selected Answer: B

As semsemccie described: configured as active-active (Standalone Primary for FAC1) so interfaces can be in different network B is correct

upvoted 2 times

...

semsemccie

1 year, 5 months ago

configured as active-active so interfaces can be in different network B is correct

upvoted 2 times

...

pplee_sh

1 year, 5 months ago

Selected Answer: D

B is wrong, Select a network interface to use for communication between the cluster members. This interface must not already have a IP address assigned and it cannot be used for authentication services. Both units must use the same interface for HA communication.

upvoted 1 times

PaloPalacios

1 year, 5 months ago

D is wrong - Other features, such as FSSO cannot be synchronized between devices. https://docs.fortinet.com/document/fortiauthenticator/6.5.3/administration-guide/122076/high-availability

upvoted 1 times

...