Deal of The Day! Hurry Up, Grab the Special Discount - Save 25% - Ends In 00:00:00 Coupon code: SAVE25
Welcome to Pass4Success

- Free Preparation Discussions

Fortinet Exam NSE8_812 Topic 1 Question 20 Discussion

Actual exam question for Fortinet's NSE8_812 exam
Question #: 20
Topic #: 1
[All NSE8_812 Questions]

An administrator has configured a FortiGate device to authenticate SSL VPN users using digital certificates. A FortiAuthenticator is the certificate authority (CA) and the Online Certificate Status Protocol (OCSP) server.

Part of the FortiGate configuration is shown below:

Based on this configuration, which two statements are true? (Choose two.)

Show Suggested Answer Hide Answer
Suggested Answer: B, D

Bis correct because the OCSP check of the certificate can be combined with a certificate revocation list (CRL). This means that the FortiGate will check the OCSP server to see if the certificate has been revoked, and it will also check the CRL to see if the certificate has been revoked.

Dis correct because if the OCSP server is unreachable, authentication will succeed if the certificate matches the CA. This is because the FortiGate will fall back to using the CRL if the OCSP server is unreachable.

The other options are incorrect. Option A is incorrect because OCSP checks can go to other OCSP servers, not just the FortiAuthenticator. Option C is incorrect because OCSP certificate responses can be cached by the FortiGate.

References:

Configuring SSL VPN authentication using digital certificates | FortiGate / FortiOS 7.2.0 - Fortinet Document Library

Online Certificate Status Protocol (OCSP) | FortiGate / FortiOS 7.2.0 - Fortinet Document Library

Certificate Revocation Lists (CRLs) | FortiGate / FortiOS 7.2.0 - Fortinet Document Library


Contribute your Thoughts:

Casey
9 months ago
I think option D is also true. If the OCSP server is unreachable, the FortiGate can still authenticate users based on the CA matching.
upvoted 0 times
...
Rasheeda
9 months ago
I agree with Using both OCSP and CRL can provide extra security measures during certificate validation.
upvoted 0 times
...
Refugia
10 months ago
I think option B is true because OCSP can be combined with a CRL for more comprehensive certificate validation.
upvoted 0 times
...
Justine
10 months ago
If the OCSP server is unreachable, authentication will still succeed if the certificate matches the CA.
upvoted 0 times
...
Ahmed
10 months ago
What about option D?
upvoted 0 times
...
Justine
10 months ago
I agree. OCSP check can be combined with a certificate revocation list.
upvoted 0 times
...
Ahmed
10 months ago
I think option B is true.
upvoted 0 times
Jina
10 months ago
B: Agreed, it enhances the overall security of the network.
upvoted 0 times
...
Lashanda
10 months ago
A: Definitely an important feature to have in SSL VPN authentication.
upvoted 0 times
...
Cheryl
10 months ago
B: Plus, it helps in quickly identifying revoked certificates.
upvoted 0 times
...
Sommer
10 months ago
A: That's right, it adds an extra layer of security.
upvoted 0 times
...
Linette
10 months ago
B: Yeah, the OCSP check can be combined with a certificate revocation list.
upvoted 0 times
...
Cory
10 months ago
A: I think option B is correct.
upvoted 0 times
...
...

Save Cancel
a