ExamGecko
Home / Fortinet / FCP_WCS_AD-7.4 / List of questions
Ask Question

Fortinet FCP_WCS_AD-7.4 Practice Test - Questions Answers, Page 3

List of questions

Question 21

Report
Export
Collapse

You need to deploy a new Windows server in AWS to offload web traffic from an existing web server in a different availability zone.

According to the AWS shared responsibility model, what three actions must you take to secure the new EC2 instance? (Choose three.)

Update software on the instance.
Update software on the instance.
Change the existing elastic load balancer (ELB) to a gateway load balancer
Change the existing elastic load balancer (ELB) to a gateway load balancer
Configure security groups.
Configure security groups.
Manage the operating system on the instance.
Manage the operating system on the instance.
Move all web servers into the same availability zone.
Move all web servers into the same availability zone.
Suggested answer: A, C, D

Explanation:

Update Software:

As part of the AWS shared responsibility model, it is the customer's responsibility to update and maintain the software running on the EC2 instance, including applying security patches and updates (Option A).

Configure Security Groups:

Security groups act as virtual firewalls for instances to control inbound and outbound traffic. Configuring them correctly is essential for securing the EC2 instance and ensuring only legitimate traffic can reach the server (Option C).

Manage Operating System:

Managing the operating system, including user accounts, permissions, and operating system patches, is the responsibility of the customer under the shared responsibility model (Option D).

Other Options Analysis:

Option B is incorrect as changing the existing ELB to a gateway load balancer is not necessary for securing the new EC2 instance.

Option E is incorrect because it is not required to move all web servers into the same availability zone for security purposes.

AWS Shared Responsibility Model: AWS Shared Responsibility

EC2 Security Best Practices: AWS EC2 Security

asked 18/09/2024
Jose Manuel GONZALEZ BALSEIRO
35 questions

Question 22

Report
Export
Collapse

An administrator wants to deploy a solution to automatically create firewall rules on FortiGate to accelerate time-to-protection for threats.

Which AWS service can be integrated with FortiGate to accomplish this?

AWS Firewall Manager
AWS Firewall Manager
AWS network access control list
AWS network access control list
SDN Connector for AWS
SDN Connector for AWS
AWS GuardDuty
AWS GuardDuty
Suggested answer: D

Explanation:

AWS GuardDuty Integration:

AWS GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior to protect AWS accounts and workloads. It can generate findings that can be used to create or update firewall rules automatically in FortiGate to enhance security and provide timely protection (Option D).

Integration with FortiGate:

GuardDuty findings can be integrated with FortiGate using automation tools and scripts to create firewall rules dynamically, thereby accelerating the time-to-protection against emerging threats.

Other Options Analysis:

Option A (AWS Firewall Manager) is more suited for managing rules across multiple accounts but not for dynamic threat response.

Option B (AWS Network ACL) provides stateless filtering but does not offer automated rule creation.

Option C (SDN Connector for AWS) helps in integrating SDN capabilities but is not specifically focused on threat-based rule automation.

AWS GuardDuty: AWS GuardDuty

FortiGate Integration: Fortinet Integration

asked 18/09/2024
Alfredo Gonzalez
34 questions

Question 23

Report
Export
Collapse

An administrator needs to attach an Elastic Network Interface (ENI) to an application instance in a VPC with multiple availability zones. An instance runs in availability zone 1.

Which ENI property must the administrator consider when implementing this requirement?

An ENI cannot attach to an instance in availability zone 2.
An ENI cannot attach to an instance in availability zone 2.
After the ENI detaches from one instance, it can reattach only to the same instance.
After the ENI detaches from one instance, it can reattach only to the same instance.
You can detach the primary ENI from an AWS instance.
You can detach the primary ENI from an AWS instance.
When you move an ENI, network traffic remains directed to the old instance until you terminate that instance.
When you move an ENI, network traffic remains directed to the old instance until you terminate that instance.
Suggested answer: A

Explanation:

ENI Attachment Across Availability Zones:

Elastic Network Interfaces (ENIs) are associated with a specific Availability Zone. They cannot be attached to instances that are in a different Availability Zone than where the ENI was created. Therefore, an ENI created in Availability Zone 1 cannot be attached to an instance in Availability Zone 2 (Option A).

ENI Reattachment:

ENIs can be detached from one instance and reattached to another instance within the same Availability Zone. This flexibility allows for network interface configuration to be preserved across instance changes within the same AZ.

Other Options Analysis:

Option B is incorrect because an ENI can be reattached to any instance in the same AZ.

Option C is incorrect as the primary ENI (eth0) cannot be detached from an instance.

Option D is incorrect because when an ENI is moved, the traffic is directed to the new instance, and there is no redirection to the old instance.

AWS ENI Documentation: Elastic Network Interfaces

AWS Networking Best Practices: AWS Networking

asked 18/09/2024
Fabrizio Leo
38 questions

Question 24

Report
Export
Collapse

Refer to the exhibit.

Fortinet FCP_WCS_AD-7.4 image Question 24 26033 09182024185905000000

What occurs during a failover for an active-passive (A-P) cluster that is deployed in two different availability zones? (Choose two.)

The cluster elastic IP address (EIP) is moved from Port1 of FGT-1 to Port1 of FGT-2.
The cluster elastic IP address (EIP) is moved from Port1 of FGT-1 to Port1 of FGT-2.
The secondary IP address of Port2 of FGT-1 is moved to Port2 of FGT-2.
The secondary IP address of Port2 of FGT-1 is moved to Port2 of FGT-2.
The default static route in the Private-AZ1 subnet route table is modified to forward all traffic to Port2 of FGT2.
The default static route in the Private-AZ1 subnet route table is modified to forward all traffic to Port2 of FGT2.
An additional route is added to the route table of the HA Sync AZ2 subnet to forward all traffic to the Internet GW.
An additional route is added to the route table of the HA Sync AZ2 subnet to forward all traffic to the Internet GW.
Suggested answer: A, B

Explanation:

Cluster Elastic IP Address (EIP) Movement:

During a failover in an active-passive (A-P) cluster, the Elastic IP (EIP) associated with the active FortiGate instance (FGT-1) needs to be moved to the passive instance (FGT-2), which becomes the new active instance. This ensures that the traffic directed to the EIP is now handled by FGT-2 (Option A).

Secondary IP Address Movement:

The secondary IP address on Port2 of the current active instance (FGT-1) is moved to the same port on the new active instance (FGT-2). This step is crucial to ensure seamless network traffic redirection and connectivity for the services relying on that IP address (Option B).

Other Options Analysis:

Option C is incorrect because the static route modification mentioned is not directly related to the failover process described.

Option D is incorrect because no additional route needs to be added to the HA Sync AZ2 subnet route table to forward traffic to the Internet Gateway during a failover.

FortiGate HA Configuration Guide: FortiGate HA

AWS Elastic IP Documentation: Elastic IP

asked 18/09/2024
Calvin Bolico
36 questions

Question 25

Report
Export
Collapse

Refer to the exhibit.

Fortinet FCP_WCS_AD-7.4 image Question 25 26034 09182024185905000000

Which two statements are correct about traffic flow in FortiWeb Cloud? (Choose two.)

Become a Premium Member for full access
  Unlock Premium Member

Question 26

Report
Export
Collapse

What is a drawback of deploying a FortiWeb VM inside a virtual public cloud (VPC) compared to FortiWeb Cloud?

Become a Premium Member for full access
  Unlock Premium Member

Question 27

Report
Export
Collapse

An AWS administrator is designing internet connectivity for an organization's virtual public cloud (VPC). The organization has web servers with private addresses that must be reachable from the internet. The web servers must be highly available.

Which two configurations can you use to ensure the web servers are highly available and reachable from the internet? (Choose two.)

Become a Premium Member for full access
  Unlock Premium Member

Question 28

Report
Export
Collapse

A global organization with cloud networks deployed in several AWS regions wants to set up next-generation firewall (NGFW) protection using FortiGate Cloud-Native Firewall (CNF).

What are two deployment considerations for the organization? (Choose two.)

Become a Premium Member for full access
  Unlock Premium Member

Question 29

Report
Export
Collapse

An organization has created a VPC with two subnets and deployed a FortiGate-VM (VM04/c4.xlarge) in AWS.

The EC2 instance is initially configured with two Elastic Network Interfaces (ENIs). The primary ENI is configured on the public subnet, and the secondary ENI is configured on the private subnet. To provide internet access for the FortiGate-VM, they now want to associate an EIP to its primary ENI, but the assignment is failing.

Which action would allow the EIP assignment to be successful?

Become a Premium Member for full access
  Unlock Premium Member

Question 30

Report
Export
Collapse

Which three statements correctly describe FortiGate Cloud-Native Firewall (CNF)? (Choose three.)

Become a Premium Member for full access
  Unlock Premium Member
Total 34 questions
Go to page: of 4
Search

Related questions