Exam NSE8_811 topic 1 question 53 discussion

Actual exam question from Fortinet's NSE8_811

Question #: 53
Topic #: 1

A FortiGate is used as a VPN hub for a number of remote spoke VPN units (Group A) spokes using a phase 1 main mode dial-up tunnel and pre-shared keys. You are asked to establish VPN connectivity for a newly acquired organization's sites for which new devices will be provisioned Group B spokes.
Both existing Group A and new Group B spoke units are dynamically addressed through a single public IP Address on the hub. You are asked to ensure that spokes from Group B have different access permissions than the existing VPN spokes units Group A.
Which two solutions meet the requirements for the new spoke group? (Choose two.)

A. Implement a new phase 1 dial-up main mode tunnel with a different pre-shared key than the Group A spokes.
B. Implement a new phase 1 dial-up main mode tunnel with certificate authentication.
C. Implement a new phase 1 dial-up main mode tunnel with pre-shared keys and XAuth.
D. Implement separate phase 1 dial-up aggressive mode tunnels with a distinct peer ID.

Show Suggested Answer

Suggested Answer: CD 🗳️

by FortiTorti at July 31, 2022, 3:13 a.m.

Comments

Submit Cancel

aioross

2 years, 6 months ago

Correct: CD

upvoted 1 times

...

kinge2

2 years, 8 months ago

Selected Answer: CD

B cannot be correct because you will still need pre-shared key in addition to Certificate based auth.

upvoted 2 times

...

FortiTorti

2 years, 9 months ago

Selected Answer: BD

B and D https://community.fortinet.com/t5/FortiGate/Technical-Tip-Dynamic-IPsec-VPN-Responder-Dialup-Selection/ta-p/189931 C cant be correct, as it will never select the 2nd tunnel

upvoted 1 times

...

Exam NSE8_811 All Questions

View all questions & answers for the NSE8_811 exam

Exam NSE8_811 topic 1 question 53 discussion

Comments

aioross

kinge2

FortiTorti

SY0-701