Deal of The Day! Hurry Up, Grab the Special Discount - Save 25% - Ends In 00:00:00 Coupon code: SAVE25
Welcome to Pass4Success

- Free Preparation Discussions
Mail Us support@pass4success.com
Location US
Mob_nav_barsMENU

Fortinet Exam NSE8_812 Topic 4 Question 37 Discussion

Actual exam question for Fortinet's NSE8_812 exam
Question #: 37
Topic #: 4
[All NSE8_812 Questions]

An administrator has configured a FortiGate device to authenticate SSL VPN users using digital certificates. A FortiAuthenticator is the certificate authority (CA) and the Online Certificate Status Protocol (OCSP) server.

Part of the FortiGate configuration is shown below:

Based on this configuration, which two statements are true? (Choose two.)

Show Suggested Answer Hide Answer
Suggested Answer: B, D

Bis correct because the OCSP check of the certificate can be combined with a certificate revocation list (CRL). This means that the FortiGate will check the OCSP server to see if the certificate has been revoked, and it will also check the CRL to see if the certificate has been revoked.

Dis correct because if the OCSP server is unreachable, authentication will succeed if the certificate matches the CA. This is because the FortiGate will fall back to using the CRL if the OCSP server is unreachable.

The other options are incorrect. Option A is incorrect because OCSP checks can go to other OCSP servers, not just the FortiAuthenticator. Option C is incorrect because OCSP certificate responses can be cached by the FortiGate.

References:

Configuring SSL VPN authentication using digital certificates | FortiGate / FortiOS 7.2.0 - Fortinet Document Library

Online Certificate Status Protocol (OCSP) | FortiGate / FortiOS 7.2.0 - Fortinet Document Library

Certificate Revocation Lists (CRLs) | FortiGate / FortiOS 7.2.0 - Fortinet Document Library


by Theodora at Oct 19, 2024, 07:04 AM

Limited Time Offer

25%

Off

Get Premium NSE8_812 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel
Christene
4 months ago
Combining the OCSP check with a CRL? Sounds like a lot of moving parts, but I guess it's better to be thorough. Hopefully, the admin knows what they're doing!
upvoted 0 times
Jose
3 months ago
As long as the admin has everything set up correctly, it should work smoothly.
upvoted 0 times
...
Edna
3 months ago
I agree, better to be safe than sorry.
upvoted 0 times
...
Sonia
3 months ago
Yeah, it can be a bit complex, but it's worth it for better security.
upvoted 0 times
...
Tamesha
4 months ago
It's always good to have multiple layers of security.
upvoted 0 times
...
...
Werner
4 months ago
I'd go with option D - if the OCSP server is down, we don't want the whole system to fall apart. Better to have a fallback plan.
upvoted 0 times
...
Jennifer
4 months ago
Caching the OCSP responses seems like a good idea, but I'm not sure if option C is correct. Either way, better safe than sorry!
upvoted 0 times
Margurite
3 months ago
That's a relief, at least there's a backup plan in case the OCSP server is down.
upvoted 0 times
...
Tyra
3 months ago
If the OCSP server is unreachable, authentication will succeed if the certificate matches the CA.
upvoted 0 times
...
Alease
3 months ago
I agree, caching the OCSP responses could be a good idea for faster authentication.
upvoted 0 times
...
Pamella
4 months ago
I think option C is correct, OCSP certificate responses are never cached by the FortiGate.
upvoted 0 times
...
...
Clemencia
5 months ago
I disagree, I believe the correct answer is D) If the OCSP server is unreachable, authentication will succeed if the certificate matches the CA.
upvoted 0 times
...
Belen
5 months ago
The OCSP check is a smart move, but I wonder if the FortiAuthenticator can handle the load. Guess we'll find out if the server gets hammered!
upvoted 0 times
Shenika
4 months ago
It's important to test the system to see how it responds to heavy traffic and potential server issues.
upvoted 0 times
...
Jerry
4 months ago
If the OCSP server gets hammered, I wonder if authentication will still succeed with the certificate matching the CA.
upvoted 0 times
...
Jesusita
4 months ago
I think the OCSP check is a good security measure, but we'll see how it performs under pressure.
upvoted 0 times
...
Jose
5 months ago
I hope the FortiAuthenticator can handle the load, otherwise, we might have some issues.
upvoted 0 times
...
...
Fabiola
5 months ago
I think the answer is A) OCSP checks will always go to the configured FortiAuthenticator.
upvoted 0 times
...

Save Cancel