Fortinet Exam NSE8_812 Topic 1 Question 25 Discussion

Actual exam question for Fortinet's NSE8_812 exam

Question #: 25
Topic #: 1

An administrator has configured a FortiGate device to authenticate SSL VPN users using digital certificates. A FortiAuthenticator is the certificate authority (CA) and the Online Certificate Status Protocol (OCSP) server.

Part of the FortiGate configuration is shown below:

Based on this configuration, which two statements are true? (Choose two.)

AOCSP checks will always go to the configured FortiAuthenticator

BThe OCSP check of the certificate can be combined with a certificate revocation list.

COCSP certificate responses are never cached by the FortiGate.

DIf the OCSP server is unreachable, authentication will succeed if the certificate matches the CA.

Show Suggested Answer

Suggested Answer: B, D

Bis correct because the OCSP check of the certificate can be combined with a certificate revocation list (CRL). This means that the FortiGate will check the OCSP server to see if the certificate has been revoked, and it will also check the CRL to see if the certificate has been revoked.

Dis correct because if the OCSP server is unreachable, authentication will succeed if the certificate matches the CA. This is because the FortiGate will fall back to using the CRL if the OCSP server is unreachable.

The other options are incorrect. Option A is incorrect because OCSP checks can go to other OCSP servers, not just the FortiAuthenticator. Option C is incorrect because OCSP certificate responses can be cached by the FortiGate.

References:

Configuring SSL VPN authentication using digital certificates | FortiGate / FortiOS 7.2.0 - Fortinet Document Library

Online Certificate Status Protocol (OCSP) | FortiGate / FortiOS 7.2.0 - Fortinet Document Library

Certificate Revocation Lists (CRLs) | FortiGate / FortiOS 7.2.0 - Fortinet Document Library

by Edgar at Jun 20, 2024, 05:28 PM

Limited Time Offer

25%

Off

Get Premium NSE8_812 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Darrel

4 months ago

That's a good point, it could be a possibility as well. Let's review the configuration again to be sure.

upvoted 0 times

...

Carline

4 months ago

But what about option B) The OCSP check of the certificate can be combined with a certificate revocation list?

upvoted 0 times

...

Willard

4 months ago

Wait, so if the OCSP server is down, the authentication still goes through? That's like having a security guard who just waves everyone in when he's not feeling it. Not very secure if you ask me!

upvoted 0 times

Jaime

3 months ago

B) The OCSP check of the certificate can be combined with a certificate revocation list.

upvoted 0 times

...

Val

3 months ago

A) OCSP checks will always go to the configured FortiAuthenticator

upvoted 0 times

...

Dorsey

4 months ago

Haha, I wonder if the exam designers were trying to trick us with that 'never cached' statement in option C. Nice try, but I'm not falling for that one!

upvoted 0 times

...

4 months ago

B and D seem to be the correct options here. OCSP is used to check the revocation status of a certificate, and if the server is unreachable, the authentication should still succeed if the certificate matches the CA.

upvoted 0 times