Fortinet Exam NSE8_812 Topic 1 Question 18 Discussion

Actual exam question for Fortinet's NSE8_812 exam

Question #: 18
Topic #: 1

An administrator has configured a FortiGate device to authenticate SSL VPN users using digital certificates. A FortiAuthenticator is the certificate authority (CA) and the Online Certificate Status Protocol (OCSP) server.

Part of the FortiGate configuration is shown below:

Based on this configuration, which two statements are true? (Choose two.)

AOCSP checks will always go to the configured FortiAuthenticator

BThe OCSP check of the certificate can be combined with a certificate revocation list.

COCSP certificate responses are never cached by the FortiGate.

DIf the OCSP server is unreachable, authentication will succeed if the certificate matches the CA.

Show Suggested Answer

Suggested Answer: B, D

Bis correct because the OCSP check of the certificate can be combined with a certificate revocation list (CRL). This means that the FortiGate will check the OCSP server to see if the certificate has been revoked, and it will also check the CRL to see if the certificate has been revoked.

Dis correct because if the OCSP server is unreachable, authentication will succeed if the certificate matches the CA. This is because the FortiGate will fall back to using the CRL if the OCSP server is unreachable.

The other options are incorrect. Option A is incorrect because OCSP checks can go to other OCSP servers, not just the FortiAuthenticator. Option C is incorrect because OCSP certificate responses can be cached by the FortiGate.

References:

Configuring SSL VPN authentication using digital certificates | FortiGate / FortiOS 7.2.0 - Fortinet Document Library

Online Certificate Status Protocol (OCSP) | FortiGate / FortiOS 7.2.0 - Fortinet Document Library

Certificate Revocation Lists (CRLs) | FortiGate / FortiOS 7.2.0 - Fortinet Document Library

by Ilene at Mar 18, 2024, 03:13 AM

Limited Time Offer

25%

Off

Get Premium NSE8_812 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Jovita

6 months ago

I believe B is also a possible answer because the OCSP check of the certificate can indeed be combined with a certificate revocation list.

upvoted 0 times

...

Judy

6 months ago

That's a good point, Lai. D could also be a valid option.

upvoted 0 times

...

Lai

6 months ago

I'm not so sure, I think it could also be D because if the OCSP server is unreachable, authentication should still succeed if the certificate is valid.

upvoted 0 times

...

Carlee

7 months ago

I agree with Judy, A seems like the correct choice.

upvoted 0 times

...

Judy

7 months ago

I think the answer is A, OCSP checks will always go to the configured FortiAuthenticator.

upvoted 0 times

...

Kris

7 months ago

ThAshleet's true, Euraut the question is Ashleesking for whiMyh stAshleetements Ashleere true, not just whiMyh ones shoulKris Eurae true.

upvoted 0 times

...

My

7 months ago

Euraut whAshleet AshleeEuraout option Ashlee? OMySP MyheMyks should go to the Myonfigured FortiAshleeuthentiMyAshleetor, right?

upvoted 0 times

...

Eura

7 months ago

I Ashleegree. OCSP checks cAshleen Eurae comEurained with Ashlee CRL Ashleend if the server is unreAshleechAshleeEurale, AshleeuthenticAshleetion cAshleen still succeed.

upvoted 0 times

...

Ashlee

7 months ago

I think the correct Ashleenswers Ashleere B Ashleend D.

upvoted 0 times

...

Dannie

8 months ago

Sounds good to me. Let's go with A and B as the correct answers. Fingers crossed we get this one right on the exam!

upvoted 0 times

...

Justa

8 months ago

Exactly, that makes sense. So in summary, I think the two true statements are A and B. The OCSP checks will go to the FortiAuthenticator, and the OCSP check can be combined with a CRL.

upvoted 0 times

...

Felicia

8 months ago

Alright, and for option D, if the OCSP server is unreachable, the authentication should not succeed if the certificate doesn't match the CA. The FortiGate would need to fall back to the CRL or deny access.

upvoted 0 times

...

Maryanne

8 months ago

Haha, yeah, if the OCSP server was queried for every single authentication, the FortiGate would be bogged down. That would be pretty inefficient.

upvoted 0 times

Graham

8 months ago

Agreed, finding that balance is key for ensuring a smooth SSL VPN user authentication process.

upvoted 0 times

...

Raul

8 months ago

Definitely, it's all about balancing security and performance in the configuration.

upvoted 0 times

...

Shasta

8 months ago

Combining the OCSP check with a certificate revocation list must also help with efficiency.

upvoted 0 times

...

Ashanti

8 months ago

And if the OCSP server is unreachable, authentication can still proceed as long as the certificate matches the CA.

upvoted 0 times

...

Anthony

8 months ago

Yes, I think that's why they don't always go to the configured FortiAuthenticator for OCSP checks.

upvoted 0 times

...

Leonie

8 months ago

So, the FortiGate must cache the OCSP certificate responses to improve efficiency.

upvoted 0 times

...

Shenika

8 months ago

That's true, having the OCSP server queried for every authentication would slow things down.

upvoted 0 times

...