Exam NSE8_812 topic 1 question 32 discussion

Actual exam question from Fortinet's NSE8_812

Question #: 32
Topic #: 1

A remote worker requests access to an SSH server inside the network. You deployed a ZTNA Rule to their FortiClient. You need to follow the security requirements to inspect this traffic.
Which two statements are true regarding the requirements? (Choose two.)

A. FortiGate can perform SSH access proxy host-key validation.
B. You need to configure a FortiClient SSL-VPN tunnel to inspect the SSH traffic.
C. SSH traffic is tunneled between the client and the access proxy over HTTPS.
D. Traffic is discarded as ZTNA does not support SSH connection rules.

Show Suggested Answer

Suggested Answer: AC 🗳️

by Viewable8041 at Sept. 5, 2023, 11:25 a.m.

Comments

Submit Cancel

node345

11 months, 2 weeks ago

Selected Answer: AC

C is tricky but still correct because it says "tunneled" and not encrypted. The SSH traffic is tunneled over TCP443, but not encrypted.

upvoted 1 times

...

Viewable8041

1 year, 5 months ago

Selected Answer: AC

Correct https://docs.fortinet.com/document/fortigate/7.4.1/administration-guide/29927/ztna-ssh-access-proxy-example

upvoted 1 times

ac89l

1 year ago

Are you sure about C because in the same link it says: When Encryption is disabled, the connection between the client and FortiGate access proxy is not encapsulated in HTTPS after the client and FortiGate connection is established. This allows for less overhead, because SSH is already a secure connection. Does this eliminate C ?

upvoted 1 times

...