CertsTopics Logo

Pre-Winter Special - Limited Time 65% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: top65certs

Fortinet FCP_WCS_AD-7.4 Dumps

Page: 1 / 3
Total 35 questions
Get FCP_WCS_AD-7.4 Full Access Download FCP_WCS_AD-7.4 PDF

FCP - AWS Cloud Security 7.4 Administrator Exam Questions and Answers

Question 1

A global organization with cloud networks deployed in several AWS regions wants to set up next-generation firewall (NGFW) protection using FortiGate Cloud-Native Firewall (CNF).

What are two deployment considerations for the organization? (Choose two.)

Options:

A.

They must choose AWS Firewall Manager to provision a CNF instance.

B.

A CNF instance is required for each AWS region that must be protected.

C.

More than one AWS account can be associated with a CNF instance.

D.

Only one CNF instance is required to protect all AWS regions.

Buy Now
Question 2

Which three statements are correct about VPC flow logs? (Choose three.)

Options:

A.

Flow logs do not capture traffic to and from 169.254.169.254 for instance metadata.

B.

Flow logs do not capture DHCP traffic.

C.

Flow logs can capture traffic to the reserved IP address for the default VPC router.

D.

Flow logs can be used as a security tool to monitor the traffic that is reaching the instance.

E.

Flow logs can capture real-time log streams for the network interfaces.

Question 3

An AWS administrator is designing internet connectivity for an organization's virtual public cloud (VPC). The organization has web servers with private addresses that must be reachable from the internet. The web servers must be highly available.

Which two configurations can you use to ensure the web servers are highly available and reachable from the internet? (Choose two.)

Options:

A.

Deploy a network load balancer.

B.

Configure a network address translation (NAT) Gateway in your VPC. Place web servers behind the NAT Gateway.

C.

Add a route to the default virtual public cloud (VPC) route table forwarding all traffic to the internet gateway.

D.

Deploy web servers in multiple availability zones.

Question 4

Refer to the exhibit.

What two conclusions can you draw from the FortiGate debug output? (Choose two.)

Options:

A.

The dynamic address object is automatically updated if the IP changes.

B.

The address object AWS Windows Server Lab can be manually changed on FortiGate.

C.

The SDN connector is correctly configured and authorized.

D.

The AWS user account used for software-defined network (SDN) integration must have full administrative rights.

Question 5

A customer has implemented GWLB between the partner and application VPCs. FortiGate appliances are deployed in the partner VPC with multiple AZs to inspect traffic transparently.

Which two things will happen to application traffic based on the GWLB deployment? (Choose two.)

Options:

A.

Inbound and outbound traffic will go to multiple devices, which will perform load balancing.

B.

Inbound and outbound traffic will go to the same device, which will perform stateful processing.

C.

The content of the original traffic exchanged between the GWLB and FortiGate will be preserved.

D.

The original trafficexchangedbetween the GWLB and FortiGate will be hashed for data integrity.

Question 6

AWS native network services offer vast functionality and inter-connectivity between the cloud and on-premises networks.

Which three additional functions can FortiGate for AWS offer to complement the native services offered by AWS? (Choose three.)

Options:

A.

Higher VPN throughput

B.

Web filtering

C.

OSPF over IPSec

D.

Advanced dynamic routing

E.

Secure SD-WAN with application visibility

Question 7

Refer to the exhibit.

You deployed an active-passive FortiGate HA cluster using a CloudFormation template on an existing VPC. Now you want to test active-passive FortiGate HA failover by running a debug so you can see the API calls to change the Elastic and secondary IP addresses.

Which statement is correct about the output of the debug?

Options:

A.

The routing table for Fgt2 updated successfully, and port2 will provide internet access to Fgt2.

B.

The Elastic IP is associated with port1 of Fgt2.

C.

IP address 10.0.0.13 is now associated with eni-0b61d8afc0aefb8a2.

D.

The Elastic IP is associated with port2 of Fgt2, and the secondary IP address for port1 and port2 was updated successfully.

Question 8

An administrator is adding a web application to be protected by FortiWeb Cloud.

Which two steps are necessary to successfully onboard the application? (Choose two.)

An administrator is adding a web application to be protected by FortiWeb Cloud.

Which two steps are necessary to successfully onboard the application? (Choose two.)

Options:

A.

Wait for the EC2 instance to be created.

B.

Provide a web application name.

C.

Create DNS records in the domain server that hosts the application.

D.

Enable a content delivery network (CDN) in the same region where your application is located.

Question 9

Refer to the exhibit.

A customer is using the AWS Elastic Load Balancer (ELB).

Which two statements are correct about the ELB configuration? (Choose two.)

Options:

A.

The load balancer is configured to load balance traffic among multiple availability zones.

B.

The Amazon Resource Name is used to access the load balancer node and targets.

C.

You can use the DNS name to reach the targets behind the ELB.

D.

The load balancer is configured for the internal traffic of the virtual public cloud (VPC).

Question 10

You are troubleshooting network connectivity issues between two VMs deployed in AWS.

One VM is a FortiGate located on subnet "LAN" that is part of the VPC "Encryption". The other VM is a Windows server located on the subnet "servers" which is also in the "Encryption" VPC. You are unable to ping the Windows server from FortiGate.

What are two reasons for this? (Choose two.)

Options:

A.

The firewall in the Windows VM is blocking the traffic.

B.

The default AWS Network Access Control List (NACL) does not allow this traffic.

C.

By default, AWS does not allow ICMP traffic between subnets.

D.

Add an inbound allow ICMP rule in the security group attached to the windows server.

Page: 1 / 3
Total 35 questions
Get FCP_WCS_AD-7.4 Full Access Download FCP_WCS_AD-7.4 PDF