Cyber Monday 2024! Hurry Up, Grab the Special Discount - Save 25% - Ends In 00:00:00 Coupon code: SAVE25
Welcome to Pass4Success

- Free Preparation Discussions
Mail Us support@pass4success.com
Location US
Mob_nav_barsMENU

Fortinet Exam NSE8_812 Topic 1 Question 27 Discussion

Actual exam question for Fortinet's NSE8_812 exam
Question #: 27
Topic #: 1
[All NSE8_812 Questions]

An administrator has configured a FortiGate device to authenticate SSL VPN users using digital certificates. A FortiAuthenticator is the certificate authority (CA) and the Online Certificate Status Protocol (OCSP) server.

Part of the FortiGate configuration is shown below:

Based on this configuration, which two statements are true? (Choose two.)

Show Suggested Answer Hide Answer
Suggested Answer: B, D

Bis correct because the OCSP check of the certificate can be combined with a certificate revocation list (CRL). This means that the FortiGate will check the OCSP server to see if the certificate has been revoked, and it will also check the CRL to see if the certificate has been revoked.

Dis correct because if the OCSP server is unreachable, authentication will succeed if the certificate matches the CA. This is because the FortiGate will fall back to using the CRL if the OCSP server is unreachable.

The other options are incorrect. Option A is incorrect because OCSP checks can go to other OCSP servers, not just the FortiAuthenticator. Option C is incorrect because OCSP certificate responses can be cached by the FortiGate.

References:

Configuring SSL VPN authentication using digital certificates | FortiGate / FortiOS 7.2.0 - Fortinet Document Library

Online Certificate Status Protocol (OCSP) | FortiGate / FortiOS 7.2.0 - Fortinet Document Library

Certificate Revocation Lists (CRLs) | FortiGate / FortiOS 7.2.0 - Fortinet Document Library


by Sabra at Jul 06, 2024, 07:16 AM

Limited Time Offer

25%

Off

Get Premium NSE8_812 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel
Luisa
4 months ago
If the OCSP server is down, authentication should fail. Can't just rely on the CA certificate match.
upvoted 0 times
Bernadine
3 months ago
That's correct. The FortiGate will still allow authentication if the OCSP server is down as long as the certificate matches the CA.
upvoted 0 times
...
Holley
3 months ago
D) If the OCSP server is unreachable, authentication will succeed if the certificate matches the CA.
upvoted 0 times
...
Nicholle
3 months ago
A) OCSP checks will always go to the configured FortiAuthenticator
upvoted 0 times
...
...
Huey
4 months ago
I'm not sure about that. I think A and D are the correct answers because OCSP checks will always go to the FortiAuthenticator and if the server is unreachable, authentication will succeed if the certificate matches the CA.
upvoted 0 times
...
Filiberto
4 months ago
Haha, imagine if OCSP responses were never cached. The FortiGate would be flooded with requests!
upvoted 0 times
Von
3 months ago
Gail: And if the OCSP server is unreachable, authentication can still succeed if the certificate matches the CA.
upvoted 0 times
...
Eliz
3 months ago
Definitely, it helps reduce the load on the FortiGate.
upvoted 0 times
...
Gail
4 months ago
Good thing OCSP responses can be cached, right?
upvoted 0 times
...
Lisbeth
4 months ago
Yeah, that would be a nightmare for the FortiGate.
upvoted 0 times
...
...
Cherrie
4 months ago
I agree with you, Cassie. The OCSP check can be combined with a certificate revocation list and if the server is unreachable, authentication will still succeed.
upvoted 0 times
...
Alfreda
5 months ago
The OCSP check can be combined with a certificate revocation list - good to have both for better security.
upvoted 0 times
German
3 months ago
That's true, having both the OCSP check and certificate revocation list adds an extra layer of security.
upvoted 0 times
...
Dante
3 months ago
D) If the OCSP server is unreachable, authentication will succeed if the certificate matches the CA.
upvoted 0 times
...
Cherrie
3 months ago
B) The OCSP check of the certificate can be combined with a certificate revocation list.
upvoted 0 times
...
Lettie
3 months ago
A) OCSP checks will always go to the configured FortiAuthenticator
upvoted 0 times
...
Lisbeth
3 months ago
D) If the OCSP server is unreachable, authentication will succeed if the certificate matches the CA.
upvoted 0 times
...
Marion
3 months ago
Yes, having both OCSP check and certificate revocation list adds an extra layer of security.
upvoted 0 times
...
Broderick
4 months ago
B) The OCSP check of the certificate can be combined with a certificate revocation list.
upvoted 0 times
...
Socorro
4 months ago
A) OCSP checks will always go to the configured FortiAuthenticator
upvoted 0 times
...
...
Corinne
5 months ago
OCSP checks will always go to the configured FortiAuthenticator. That makes sense since it's the CA.
upvoted 0 times
Serina
4 months ago
It's important to have that set up for secure authentication.
upvoted 0 times
...
Rene
4 months ago
Yes, that's correct. The OCSP checks will always go to the configured FortiAuthenticator.
upvoted 0 times
...
...
Cassie
5 months ago
I think the correct answers are B and D.
upvoted 0 times
...

Save Cancel