VCEdump

FCP_WCS_AD-7.4 FCP - AWS Cloud Security 7.4 Administrator

PDF question preview Back to product

Free preview

6 sample questions

The complete product contains 35 questions.

Question formats

Single choice1

Multiple choice5

Compare study plans

Fortinet · FCP_WCS_AD-7.4

FCP_WCS_AD-7.4 questions and answers

Review the question wording, option layout, and available explanations before choosing a study plan.

Question 1

Single choice

Refer to the exhibit.

Traffic is initiated from the EC2 instance and is destined for the internet.

Which traffic flow is correct?

A
EC2 instance > NAT GW > IGW > internet
B
There is no route to the internet in the Private Route Table. The traffic does not reach the internet.
C
EC2 instance > GWLBe > NAT GW > IGW > internet
D
EC2 instance > GWLBe > internet

Reveal answer details Close answer details

Correct answerC

Question 2

Multiple choice

Which three statements are correct about VPC flow logs? (Choose three.)

A
Flow logs do not capture traffic to and from 169.254.169.254 for instance metadata.
B
Flow logs do not capture DHCP traffic.
C
Flow logs can capture traffic to the reserved IP address for the default VPC router.
D
Flow logs can be used as a security tool to monitor the traffic that is reaching the instance.
E
Flow logs can capture real-time log streams for the network interfaces.

Reveal answer details Close answer details

Correct answersA, B, D

Question 3

Multiple choice

A customer has deployed FortiGate Cloud-Native Firewall (CNF).

Which two statements are correct about policy sets? (Choose two.)

A
There is an implicit deny rule at the bottom of the policy set.
B
The policy set must be manually synchronized to the CNF instance each time it is modified.
C
A new policy set is created with each deployed CNF instance.
D
Multiple policy sets can be applied to a single CNF instance.

Reveal answer details Close answer details

Correct answersA, C

Question 4

Multiple choice

Refer to the exhibit.

What two conclusions can you draw from the FortiGate debug output? (Choose two.)

A
The dynamic address object is automatically updated if the IP changes.
B
The address object AWS Windows Server Lab can be manually changed on FortiGate.
C
The SDN connector is correctly configured and authorized.
D
The AWS user account used for software-defined network (SDN) integration must have full administrative rights.

Reveal answer details Close answer details

Correct answersA, C

Question 5

Multiple choice

A global organization with cloud networks deployed in several AWS regions wants to set up next-
generation firewall (NGFW) protection using FortiGate Cloud-Native Firewall (CNF).

What are two deployment considerations for the organization? (Choose two.)

A
They must choose AWS Firewall Manager to provision a CNF instance.
B
A CNF instance is required for each AWS region that must be protected.
C
More than one AWS account can be associated with a CNF instance.
D
Only one CNF instance is required to protect all AWS regions.

Reveal answer details Close answer details

Correct answersB, C

Question 6

Multiple choice

AWS native network services offer vast functionality and inter-connectivity between the cloud and on-premises networks.

Which three additional functions can FortiGate for AWS offer to complement the native services offered by AWS? (Choose three.)

A
Higher VPN throughput
B
Web filtering
C
OSPF over IPSec
D
Advanced dynamic routing
E
Secure SD-WAN with application visibility

Reveal answer details Close answer details

Correct answersB, C, E