Free FCSS_CDS_AR-7.6: FCSS - Public Cloud Security 7.6 Architect Exam Questions and Answers

An administrator deploys FortiGate-VM instances behind an AWS Gateway Load Balancer (GWLB) for traffic inspection. Which protocol does the GWLB use to encapsulate the traffic that it sends to the FortiGate instances?

• AA. GRE over IP protocol 47
• BB. VXLAN on UDP port 4789
• CC. IPsec with NAT-T on UDP port 4500
• DD. GENEVE on UDP port 6081

Refer to the exhibit. Exhibit: FGT-AWS # diagnose debug application awsd -1 FGT-AWS # diagnose debug enable awsd: sdn connector aws-prod, sending DescribeInstances to ec2.us-east-1.amazonaws.com awsd: HTTP response code 403 awsd: <Code>UnauthorizedOperation</Code> awsd: You are not authorized to perform this operation. A FortiGate-VM in AWS uses an SDN connector named aws-prod that is configured to use the IAM role of the instance profile. The connector reaches the EC2 API endpoint, but the dynamic address objects that use the connector stay empty. What must the administrator do?

• AA. Change the region setting of the SDN connector to match the Availability Zone of the FortiGate instance
• BB. Enable source NAT on the firewall policy that references the dynamic address objects
• CC. Open outbound TCP port 443 to the EC2 API endpoint in the security group of the FortiGate management interface
• DD. Attach an IAM policy that allows the ec2:Describe* actions to the role in the instance profile of the FortiGate

An administrator deploys a FortiGate-VM in a hub VNet in Azure. Two spoke VNets are peered with the hub VNet, and IP forwarding is already enabled on the FortiGate network interfaces. The administrator must inspect all internet-bound traffic from the spoke subnets on the FortiGate. What must the administrator configure on the spoke subnets?

• AA. A user-defined route for 0.0.0.0/0 with next hop type Virtual appliance and the private IP address of the FortiGate internal interface
• BB. A peering setting on each spoke VNet that uses the remote virtual network gateway of the hub VNet
• CC. A network security group rule that allows outbound traffic only to the private IP address of the FortiGate internal interface
• DD. A user-defined route for 0.0.0.0/0 with next hop type Virtual network gateway and the public IP address of the FortiGate

Refer to the exhibit. Exhibit: config system probe-response set port 8008 set mode http-probe set http-probe-value OK end config system interface edit "port1" set mode dhcp set allowaccess ping probe-response next edit "port2" set mode dhcp set allowaccess ping https ssh next end Azure Load Balancer (internal) Backend pool: port2 IP addresses of both FortiGate VMs Health probe: HTTP, port 8008, path / Backend health: Down for both instances An administrator deploys two FortiGate VMs behind an Azure internal load balancer. Both backend instances are reported as Down. What is the cause?

• AA. The interface that receives the probes does not have probe-response in its allowaccess setting
• BB. A firewall policy that allows the probe source address to the port2 interface is missing
• CC. The http-probe-value must be changed to match the name of the backend pool in the load balancer
• DD. The probe port 8008 conflicts with the HTTPS administrative service and must be changed to 443

A security team uses one CloudFormation template to deploy a FortiGate-VM instance in several AWS Regions. The FortiGate AMI ID is different in every Region. The administrator wants the template to select the correct AMI ID automatically, without asking for input when the stack is created. What should the administrator add to the template?

• AA. A Mappings section that is keyed by Region and is referenced with Fn::FindInMap and the AWS::Region pseudo parameter
• BB. A Parameters entry of type String for the AMI ID with a default value taken from the us-east-1 Region
• CC. An Outputs section that exports the AMI ID of each Region so that the instance resource can read it with Fn::ImportValue
• DD. A Conditions section that evaluates Fn::Equals against the Region name and enables a separate instance resource for each Region

Refer to the exhibit. Exhibit: Effective routes for the network interface of a VM in the spoke subnet 10.1.1.0/24 Source State Address Prefixes Next Hop Type Next Hop IP Default Active 10.1.0.0/16 VnetLocal - Default Active 10.0.0.0/16 VNetPeering - Default Invalid 0.0.0.0/0 Internet - User Active 0.0.0.0/0 VirtualAppliance 10.0.2.4 The FortiGate has the internal interface address 10.0.2.4 in the hub VNet 10.0.0.0/16. Internet traffic from the spoke VM appears in the FortiGate traffic logs. Traffic from the same VM to a database server at 10.0.5.10 in the hub VNet does not appear in the logs. What must the administrator do so that this traffic is inspected?

• AA. Add a user-defined route for 10.0.0.0/16 with next hop type Virtual appliance and next hop address 10.0.2.4
• BB. Disable the Allow forwarded traffic setting on the peering connection of the spoke VNet
• CC. Enable propagation of gateway routes on the route table that is associated with the spoke subnet
• DD. Change the next hop type of the 0.0.0.0/0 user-defined route to Virtual network gateway

Refer to the exhibit. Exhibit: Route table rtb-0a1b72 (associated with subnet-app, 10.0.2.0/24) Destination Target Status 10.0.0.0/16 local active 0.0.0.0/0 igw-0c4d21 active An administrator deploys a FortiGate-VM with port1 and port2 in VPC 10.0.0.0/16. Instances in subnet-app have Elastic IP addresses and can reach the internet, but the FortiGate traffic logs show no sessions from these instances. All internet-bound traffic from subnet-app must be inspected by the FortiGate. What must the administrator do?

• AA. Enable the source/destination check on the FortiGate network interfaces
• BB. Add an inbound rule for the FortiGate port2 subnet to the security group of the instances in subnet-app
• CC. Add a second 0.0.0.0/0 route that targets the FortiGate port2 with a lower metric than the internet gateway route
• DD. Change the target of the 0.0.0.0/0 route to the network interface of the FortiGate port2

An administrator deploys two FortiGate-VMs in an active-passive FortiGate Clustering Protocol (FGCP) cluster across two Availability Zones in an AWS VPC. Which two statements about this deployment are true? (Choose two.)

Select 2 answers.

• AA. After a failover, the new primary FortiGate calls the AWS API to move the Elastic IP address and update the VPC route table entries
• BB. The HA heartbeat between the two FortiGate-VMs uses multicast packets sent on a subnet that spans both Availability Zones
• CC. After a failover, the new primary FortiGate sends gratuitous ARP packets that update the VPC route tables in both Availability Zones
• DD. Each FortiGate-VM needs an IAM role that allows the EC2 API actions used to reassign the Elastic IP address and routes

An administrator declares input variables for a FortiGate deployment in a file named variables.tf. Terraform must load the values for these variables automatically at run time without extra command-line options. Which file should contain the values?

• AA. terraform.tfstate
• BB. providers.tf
• CC. outputs.tf
• DD. terraform.tfvars

Refer to the exhibit. Exhibit: id=20085 trace_id=7 func=print_pkt_detail line=5851 msg="vd-root:0 received a packet(proto=6, 198.51.100.24:49822->10.0.1.10:80) tun_id=0.0.0.0 from port1. flag [S], seq 1180, ack 0, win 64240" id=20085 trace_id=7 func=__ip_session_run_tuple line=3570 msg="DNAT 10.0.1.10:80->10.0.2.20:80" id=20085 trace_id=7 func=vf_ip_route_input_common line=2605 msg="find a route: flag=00000000 gw-10.0.2.20 via port2" id=20085 trace_id=7 func=fw_forward_handler line=822 msg="Denied by forward policy check (policy 0)" An administrator publishes a web server behind a FortiGate-VM in AWS by using an Elastic IP address and a virtual IP (VIP). Clients cannot connect on TCP port 80. The administrator runs a debug flow and gets the output shown. What must the administrator do?

• AA. Disable the source/destination check on the web server network interface
• BB. Add a static route for 198.51.100.24/32 with port1 as the outgoing interface
• CC. Add an inbound rule for TCP port 80 to the security group of the FortiGate port1 network interface
• DD. Create a firewall policy from port1 to port2 that uses the VIP object as the destination address