Fortinet FCP_WCS_AD-7.4 Online Practice Questions and Exam Preparation

Fortinet FCP_WCS_AD-7.4 Online Questions & Answers

• Question 1:

  An administrator wants to deploy a solution to automatically create firewall rules on FortiGate to accelerate time-to-protection for threats. Which AWS service can be integrated with FortiGate to accomplish this?

  A. AWS Firewall Manager
  B. AWS network access control list
  C. SDN Connector for AWS
  D. AWS GuardDuty
  D. AWS GuardDuty

• Question 2:

  A global organization with cloud networks deployed in several AWS regions wants to set up next-generation firewall (NGFW) protection using FortiGate Cloud-Native Firewall (CNF). What are two deployment considerations for the organization? (Choose two.)

  A. They must choose AWS Firewall Manager to provision a CNF instance.
  B. A CNF instance is required for each AWS region that must be protected.
  C. More than one AWS account can be associated with a CNF instance.
  D. Only one CNF instance is required to protect all AWS regions.
  B. A CNF instance is required for each AWS region that must be protected.
  C. More than one AWS account can be associated with a CNF instance.

• Question 3:

  You want to deploy the Fortinet HA CloudFormation template to stage and bootstrap the FortiGate configuration in the same region in which you created your VPC, which is Ohio US-East-2. Based on this information, which statement is correct?

  A. You create an S3 bucket to stage and bootstrap FortiGate with an FGCP unicast configuration. The S3 bucket can be hosted in any region.
  B. The Fortinet HA cloud formation template automatically creates an S3 bucket.
  C. You create an S3 bucket to stage and bootstrap FortiGate with an FGCP unicast configuration. The S3 bucket needs to be hosted in the Ohio US-East-2 region.
  D. You create a DynamoDB to stage and bootstrap FortiGate with an FGCP unicast configuration. It needs to be hosted in the Ohio US-East-2 region.
  C. You create an S3 bucket to stage and bootstrap FortiGate with an FGCP unicast configuration. The S3 bucket needs to be hosted in the Ohio US-East-2 region.

• Question 4:

  Refer to the exhibit.

  

  Traffic is initiated from the EC2 instance and is destined for the internet. Which traffic flow is correct?

  A. EC2 instance > NAT GW > IGW > internet
  B. There is no route to the internet in the Private Route Table. The traffic does not reach the internet.
  C. EC2 instance > GWLBe > NAT GW > IGW > internet
  D. EC2 instance > GWLBe > internet
  C. EC2 instance > GWLBe > NAT GW > IGW > internet

• Question 5:

  A cloud administrator is tasked with protecting web applications hosted in AWS cloud.

  Which three Fortinet cloud offerings can the administrator choose from to accomplish the task? (Choose three.)

  A. AWS WAF
  B. FortiEDR
  C. FortiGate Cloud-Native Firewall (CNF)
  D. Fortinet Managed Rules for AWS WAF
  E. FortiWeb Cloud
  C. FortiGate Cloud-Native Firewall (CNF)
  D. Fortinet Managed Rules for AWS WAF
  E. FortiWeb Cloud

• Question 6:

  Refer to the exhibit.

  

  You deployed an active-passive FortiGate HA cluster using a CloudFormation template on an existing VPC. Now you want to test active-passive FortiGate HA failover by running a debug so you can see the API calls to change the Elastic and secondary IP addresses.

  Which statement is correct about the output of the debug?

  A. The routing table for Fgt2 updated successfully, and port2 will provide internet access to Fgt2.
  B. The Elastic IP is associated with port1 of Fgt2.
  C. IP address 10.0.0.13 is now associated with eni-0b61d8afc0aefb8a2.
  D. The Elastic IP is associated with port2 of Fgt2, and the secondary IP address for port1 and port2 was updated successfully.
  B. The Elastic IP is associated with port1 of Fgt2.

• Question 7:

  An administrator is adding a web application to be protected by FortiWeb Cloud. Which two steps are necessary to successfully onboard the application? (Choose two.)

  A. Wait for the EC2 instance to be created.
  B. Provide a web application name.
  C. Create DNS records in the domain server that hosts the application.
  D. Enable a content delivery network (CDN) in the same region where your application is located.
  B. Provide a web application name.
  C. Create DNS records in the domain server that hosts the application.

• Question 8:

  Refer to the exhibit.

  

  Which statement is correct about the VPC peering connections shown in the exhibit?

  A. To route packets directly from VPC B to VPC C through VPC A, you must add a route for network 192.168.0.0/16 in the VPC A routing table.
  B. You cannot route packets directly from VPC B to VPC C through VPC A.
  D. You cannot create a separate VPC peering connection between VPC B and VPC C to route packets directly.
  B. You cannot route packets directly from VPC B to VPC C through VPC A.

• Question 9:

  A customer has deployed FortiGate Cloud-Native Firewall (CNF). Which two statements are correct about policy sets? (Choose two.)

  A. There is an implicit deny rule at the bottom of the policy set.
  B. The policy set must be manually synchronized to the CNF instance each time it is modified.
  C. A new policy set is created with each deployed CNF instance.
  D. Multiple policy sets can be applied to a single CNF instance.
  A. There is an implicit deny rule at the bottom of the policy set.
  C. A new policy set is created with each deployed CNF instance.

• Question 10:

  Refer to the exhibit.

  

  What two conclusions can you draw from the FortiGate debug output? (Choose two.)

  A. The dynamic address object is automatically updated if the IP changes.
  B. The address object AWS Windows Server Lab can be manually changed on FortiGate.
  C. The SDN connector is correctly configured and authorized.
  D. The AWS user account used for software-defined network (SDN) integration must have full administrative rights.
  A. The dynamic address object is automatically updated if the IP changes.
  C. The SDN connector is correctly configured and authorized.