Exam NSE8_811 topic 1 question 26 discussion

Actual exam question from Fortinet's NSE8_811

Question #: 26
Topic #: 1

A customer has a SCADA environmental control device that is triggering a false-positive IPS alert whenever the Web GUI of the device is accessed. You cannot create a functional custom IPS filter to exempt this behavior, and it appears that the device is so old that it does not have HTTPS support. You need to prevent the false positive IPS alerts from occurring.
In this scenario, which two actions will accomplish this task? (Choose two.)

A. Create a URL filter with the Exempt action for that device IP address.
B. Change the relevant firewall policies to use SSL certificate-inspection instead of SSL deep-inspection.
C. Create a very specific firewall policy for that device IP address which does not perform IPS scanning.
D. Reconfigure the FortiGate to operate in proxy-based inspection mode instead of flow-based.

Show Suggested Answer

Suggested Answer: AC 🗳️

by kinge2 at Aug. 24, 2022, 9:19 a.m.

Comments

Submit Cancel

mohmed92

5 months ago

Selected Answer: AC

AC are the correct answers, Since the device is legacy system , the options you will have to exempt it by URL Filter for that device IP address and FW policy without any IPS profile to scan that device IP address.

upvoted 1 times

...

kinge2

2 years, 9 months ago

Selected Answer: AC

Sorry B is worng as device does not support any form on HTTPS inspection. A is correct as you can create simple url static filter with IP address of legacy device.

upvoted 1 times

...

kinge2

2 years, 9 months ago

Selected Answer: BC

A is not correct because you cannot create IP exception for static URL filter. You can exempt only specific URLs

upvoted 1 times

...